Locating systems that do not flatten your OT security model.

You cannot secure gateways, anchors and cloud agents you have not listed. We start with a living OT/IoT inventory and data flows — including the vendor’s remote support path.

See OT cybersecurity and IT/OT ownership.

IEC 62443-minded zoning beats a flat wireless subnet. East-west monitoring, least privilege for location platforms, and store-and-forward that does not punch holes “temporarily” forever.

OEM tunnels and always-on support VPNs are a common breach path. Time-box, MFA, log, and refuse architectures that require permanent vendor presence on the plant floor.

We do not resell the stack under review. Architecture recommendations are written so you can swap suppliers without inheriting their security shortcuts.

Gateways, anchors and cloud agents belong on the OT/IoT inventory with data-flow diagrams that include the vendor remote-support path. IEC 62443-minded zoning beats a flat wireless subnet. Time-box OEM tunnels, require MFA, log access, and refuse permanent unrestricted presence on the plant floor.

We do not resell the stack under review — architecture recommendations are written so you can swap suppliers without inheriting their security shortcuts. See IT & OT.

We map data residency, identity federation and blast radius before recommending cloud location platforms vs on-prem/enclave. Firmware is OT change: windows, signed updates, rollback — not shadow IT.

Locating systems are OT: anchors, gateways and identity sitting on networks you already secure. Security buying criteria:

• Zone and conduit design — Purdue/IEC 62443-minded placement before vendor convenience Wi-Fi.
• Identity and RBAC — who can query raw positions vs aggregated analytics; audit of every sensitive query.
• Vendor remote access — jump hosts, MFA, time-boxed sessions, logged changes — or none.
• Supply-chain posture — SBOM, SOC 2 / ISO 27001, patch cadence, vulnerability disclosure.
• Enclave options — on-prem or air-gapped paths where policy requires it.

Platform vendors minimise friction with cloud defaults. SIs minimise install time with flat VLANs. Neither is a control. CISO review should treat locating like any other OT project.

• Flat wireless shared with production or guest networks.
• Default cloud admin and overly broad API keys.
• Location telemetry that identifies staff without privacy controls agreed with the DPO.
• Unmonitored vendor VPN into OT.
• No SIEM mapping for gateways, auth failures and config changes.

• Where do anchors, gateways and middleware sit in our zone model — and what conduits are required?
• Mutual TLS, encryption at rest, RBAC and audit: demonstrate configuration, not a datasheet claim.
• How is vendor support access controlled, logged and revocable?
• Provide SBOM and patch SLA for firmware and cloud components.
• Can the system run fully on-prem with no outbound dependency for our high-risk sites?
• How do events land in our SIEM (syslog/CEF/JSON) with a mapped use-case list?

We architect locating as OT from gate 1 and score vendors against your control framework — without selling gateways, sensors or AMR fleets. Independence is a control: recommendations are not distorted by hardware margin.

Platform vendors increasingly market SOC 2, mutual TLS and 'enterprise-ready' RTLS. Those controls matter — but only when configured into your zone model, IdP and SIEM. SIs may propose flat VLANs to accelerate install. Big consultancies may treat locating as another IoT workstream without OT depth. None of those incentives automatically produce IEC 62443-minded conduits, time-boxed vendor access or SBOM discipline.

Ask who patches gateway firmware after year one, who rotates certificates, and whether raw staff location queries are logged like privileged access. If the answer is 'the cloud console defaults', the risk register is incomplete.

Locating also expands the attack and privacy surface: position telemetry can reveal process secrets and identifiable movement. CISO and DPO alignment at gate 1 prevents security signing off a design privacy will later block — or the reverse.

• Documented zone/conduit diagram for anchors, gateways and middleware.
• Vendor remote-access standard matching OT jump-host practice.
• RBAC matrix distinguishing asset maps from identifiable people paths.
• SIEM use cases for auth failures, config changes and anomalous query volume.
• Enclave or on-prem option scored for high-sensitivity sites even if the HQ prefers SaaS.

TRACIO scores vendors against that bar as an independent advisor — we do not sell the sensors we review.

Gateways, anchors and cloud agents belong on the OT/IoT inventory with data-flow diagrams that include the vendor remote-support path. IEC 62443-minded zoning beats a flat wireless subnet. Time-box OEM tunnels, require MFA, log access, and refuse permanent unrestricted presence on the plant floor.

We do not resell the stack under review — architecture recommendations are written so you can swap suppliers without inheriting their security shortcuts. See IT & OT.

Locating systems are OT: anchors, gateways and identity sitting on networks you already secure. Security buying criteria:

• Zone and conduit design — Purdue/IEC 62443-minded placement before vendor convenience Wi-Fi.
• Identity and RBAC — who can query raw positions vs aggregated analytics; audit of every sensitive query.
• Vendor remote access — jump hosts, MFA, time-boxed sessions, logged changes — or none.
• Supply-chain posture — SBOM, SOC 2 / ISO 27001, patch cadence, vulnerability disclosure.
• Enclave options — on-prem or air-gapped paths where policy requires it.

Platform vendors minimise friction with cloud defaults. SIs minimise install time with flat VLANs. Neither is a control. CISO review should treat locating like any other OT project.

• Flat wireless shared with production or guest networks.
• Default cloud admin and overly broad API keys.
• Location telemetry that identifies staff without privacy controls agreed with the DPO.
• Unmonitored vendor VPN into OT.
• No SIEM mapping for gateways, auth failures and config changes.

• Where do anchors, gateways and middleware sit in our zone model — and what conduits are required?
• Mutual TLS, encryption at rest, RBAC and audit: demonstrate configuration, not a datasheet claim.
• How is vendor support access controlled, logged and revocable?
• Provide SBOM and patch SLA for firmware and cloud components.
• Can the system run fully on-prem with no outbound dependency for our high-risk sites?
• How do events land in our SIEM (syslog/CEF/JSON) with a mapped use-case list?

We architect locating as OT from gate 1 and score vendors against your control framework — without selling gateways, sensors or AMR fleets. Independence is a control: recommendations are not distorted by hardware margin.

Platform vendors increasingly market SOC 2, mutual TLS and 'enterprise-ready' RTLS. Those controls matter — but only when configured into your zone model, IdP and SIEM. SIs may propose flat VLANs to accelerate install. Big consultancies may treat locating as another IoT workstream without OT depth. None of those incentives automatically produce IEC 62443-minded conduits, time-boxed vendor access or SBOM discipline.

Ask who patches gateway firmware after year one, who rotates certificates, and whether raw staff location queries are logged like privileged access. If the answer is 'the cloud console defaults', the risk register is incomplete.

Locating also expands the attack and privacy surface: position telemetry can reveal process secrets and identifiable movement. CISO and DPO alignment at gate 1 prevents security signing off a design privacy will later block — or the reverse.

• Documented zone/conduit diagram for anchors, gateways and middleware.
• Vendor remote-access standard matching OT jump-host practice.
• RBAC matrix distinguishing asset maps from identifiable people paths.
• SIEM use cases for auth failures, config changes and anomalous query volume.
• Enclave or on-prem option scored for high-sensitivity sites even if the HQ prefers SaaS.

TRACIO scores vendors against that bar as an independent advisor — we do not sell the sensors we review.