---
title: "Rolling out machine monitoring with no IT team"
description: "Yes. Put sensors on a cellular router that never joins the plant network, or on a guest network. Compare the three paths, who does each step and what IT needs."
category: "Machines and connectivity"
author: "Mahmoud Parto"
published: "2026-10-28"
updated: "2026-11-02"
source_url: "https://www.iotflows.com/blog/rollout-without-an-it-team/"
---
> Question: Can a small plant deploy monitoring without an IT change request?

## Key takeaways

- A cellular router gives sensors their own Wi-Fi and their own internet path, so the plant network needs no change request.
- A guest network works for sensors when it offers 2.4 GHz at the machines, a fixed password and no sign-in page.
- Sensors that mount on the outside of a machine touch no PLC or controller, so there is nothing on the controls to review.
- With no IT person, the maintenance lead mounts and connects the sensors and the plant manager owns the rollout.
- Send IT or the owner one page that covers what connects, where its traffic goes and how to undo it.

Yes, a small plant can deploy machine monitoring without an IT change request, as long as the sensors never join the plant network. A cellular router gives them their own Wi-Fi and its own path to the internet. Sensors that mount on the outside of a machine touch no controller. The plant network, its firewall and every PLC stay exactly as they were.

This guide is for owners and plant managers at plants where IT is a contractor, a part-time role or nobody. It compares the three network paths, says who does each step, and ends with a one-page note for IT and a week-one checklist.

## What does monitoring need from the network?

Monitoring sensors need power at the machine and a path to the internet from where they're mounted. That's all. The question for a small plant is whose network carries that path, and who has to agree to it.

> **Definition.** **IT change request** is a formal request to whoever runs a plant's network to add or change something on it, such as admitting a new device to the Wi-Fi or opening a firewall port, reviewed and approved before the change goes live.

Most manufacturers have no IT department to file it with. Of the 239,265 US manufacturing firms counted in 2022, 93.1% had fewer than 100 employees, and around three-quarters had fewer than 20.[1] In a 20-person shop, the network often belongs to the owner, an office manager or a contractor who visits once a month.

The controls are a separate question. A sensor-only rollout reads vibration, sound or passing parts from the outside, and touches no [PLC](/docs/get-started/glossary/#plc) or CNC control. Connecting to a controller is a security concern for many plants, so IT usually reviews it first, as [why machine connections stall](/blog/machine-communication-protocols/#why-stall) explains. Leave the controls out of a first rollout and that review never starts.

## What are the three ways to connect the sensors?

You can put the sensors on the plant Wi-Fi, on a guest or separate network, or on a cellular router of their own. Each one asks something of a different person.

Figure: Three paths from sensors to the cloud. Plant Wi-Fi shares the office network and needs a change request. A guest network uses the plant's internet line and needs its password. A cellular router uses its own Wi-Fi and 4G/LTE and needs nothing.

*Three ways to get sensors online: only the cellular router keeps them off every network the plant owns.*

| | Plant Wi-Fi | Guest or separate network | Cellular router |
|---|---|---|---|
| Who you need | IT or the network owner | Whoever has the guest password | Nobody on the network side |
| Change to the plant network | Each device admitted | None, if the network exists | None |
| Sensors share a network with | Office PCs, often controls | Visitors' phones | Only other sensors |
| Internet path | The plant's line | The plant's line | The router's cellular uplink |
| Works where | Plant Wi-Fi reaches the machine | Guest Wi-Fi reaches the machine | A phone gets signal |
| Running cost | None | None | A monthly data plan |

NIST's guide to OT security recommends separating OT networks from the corporate network. In its example architecture for a PLC-based plant with IIoT devices, it puts those devices on separate network segments of their own.[2] A guest network and a cellular router both get you there without a network project.

### Plant Wi-Fi, with IT

Plant Wi-Fi costs nothing extra and suits a plant whose IT already admits devices quickly. It needs these things from IT or the network owner:

- a 2.4 GHz network that reaches every machine, since many sensors have no 5 GHz radio;
- a shared password (WPA2 or WPA3) rather than a per-user login;
- the device addresses added to any allow list, if the network filters by MAC address;
- outbound HTTPS on port 443 to the vendor's cloud.

Check coverage at the mount point, not at the office door. A sensor has to hold the network [from where it's mounted](/docs/hardware/connect-to-wifi/#network), and a machine at the far end of a steel building often sits at the edge of coverage.

### A guest or separate network

A guest network keeps visitors' devices away from the plant's own systems, which is the same separation the sensors want. It needs nothing from IT beyond the password, and the sensors share only the plant's internet line.

Check three things first. The guest network must offer 2.4 GHz at the machines. It must have no sign-in page, because a sensor has no screen to click "accept" on. And its password must stay fixed.

> **Rotating guest passwords drop every sensor**
>
> Some guest networks change their password every week or month. Each sensor stores the password it joined with, so the next rotation takes every one of them offline at once. Ask for a fixed password, or set up a separate network for the sensors.

A *separate network* is a second Wi-Fi name and access point set up only for the sensors, on the plant's internet line but apart from its systems. A contractor who installs Wi-Fi can add one without touching the plant's own network.

### A cellular router

A cellular router creates its own Wi-Fi network for the sensors and sends their traffic over a mobile data connection. The sensors never join a network the plant owns, so there's nothing for IT to admit and nothing on the plant network to change.

> **Definition.** **Network isolation** means two networks have no route between them, so devices on one cannot reach systems on the other, and each network reaches the internet only through its own connection.

What a router needs is signal. Site it where a phone gets a usable signal, then check how far its Wi-Fi reaches the machines. A plant with two bays far apart may need one router in each. Whatever the path, NIST asks that OT data be protected in transit over untrusted paths such as cellular and the internet, so confirm the vendor encrypts the connection.[2]

## Which network path should you choose?

When there's no IT person, default to a cellular router. It's the only path that needs nobody's approval and leaves the plant network untouched.

- **Choose plant Wi-Fi when** IT approves new devices within days, the Wi-Fi reaches every machine at 2.4 GHz, and you'd rather pay no data plan.
- **Choose a guest or separate network when** the building has weak cellular signal but a guest network reaches the floor with a fixed password and no sign-in page.
- **Choose a cellular router when** nobody runs the network, a review would take longer than the rollout, the machines sit outside Wi-Fi coverage, or the owner wants the sensors off the plant network entirely.

For example, take a 25-person job shop with 12 CNC machines in one bay, phone signal near the loading door, and an IT contractor who visits once a month. A cellular router by the door covers the bay, and the contractor gets the one-page note for the file instead of a ticket.

You don't need a cellular router if IT has already approved the devices and the Wi-Fi reaches every mount point. Start on plant Wi-Fi and skip the data plan.

Figure: A decision flow. If IT will approve the sensors for plant Wi-Fi this week, use it. If not and a phone gets signal near the machines, use a cellular router. Failing that, a guest network with 2.4 GHz, or else a separate network.

*Three questions settle the network path; with no IT person, the second one usually decides it.*

## Who does the work when there's no IT person?

The maintenance lead does the hands-on work and the plant manager owns the rollout. Neither job needs networking skills when the sensors run on a cellular router or an existing guest network.

| Task | Who does it | When |
|---|---|---|
| Choose the network path | Owner or plant manager | Before ordering |
| Check signal at the machines | Maintenance lead, with a phone | Before ordering |
| Send the one-page note | Plant manager | Before install day |
| Set shifts and the timezone | Plant manager | Before the first sensor reports |
| Mount and connect the sensors | Maintenance lead | Install day |
| Check running and idle on each machine | Maintenance lead, with the operator | Install day |
| Check every device is online | Maintenance lead | Every Monday |

A sensor that mounts on the outside of a machine needs no electrician. A current clamp inside the electrical cabinet does, and [monitoring an old machine](/blog/monitor-old-machines-without-a-plc/#methods) compares the two.

The operator's part is short: run the machine through a few full cycles, then leave it powered and idle, so the maintenance lead can confirm the two read differently.

If nobody on staff wants to own the rollout, your state's Manufacturing Extension Partnership center can help. NIST's MEP network has nearly 1,400 manufacturing advisors across the country.[3]

## What should you tell IT or the owner?

Tell them what connects, what it touches, where its traffic goes and how to undo it, on one page. A contractor or owner reads one page; a 20-page security pack sits in an inbox.

Put these seven lines in the note:

1. **What it is.** A sensor on each of the 12 machines on Line 1, reading vibration and sound from the outside.
2. **What it touches.** No PLC, no CNC control and no wiring into the machine.
3. **Which network.** The sensors' own cellular router, or the guest network, named. They don't join the plant network.
4. **Where the traffic goes.** Out to the vendor's cloud over HTTPS on port 443, encrypted in transit.
5. **Who can see the data.** Named accounts, invited by the plant, with the roles each one holds.
6. **How to undo it.** Unplug the router and lift the sensors off. Nothing on the machines or the network needs changing back.
7. **Who to call.** The plant's owner for the rollout, and the vendor's support contact.

Attach the vendor's security page if IT asks for more. If the note later grows a line about connecting a controller, that's the point to bring IT in.

## Roll out IoTFlows without an IT ticket

The IoTFlows [4G/LTE Router (IFCR-150)](/docs/hardware/lte-router/#isolation) gives the sensors their own 2.4 GHz network and reaches the cloud over 4G/LTE. It ships configured with its SIM fitted and needs no IT change request. Devices within 100 ft (30 m) join it on their own, and it keeps every device behind it off the plant network. One router serves a cell, not one per machine.

[SenseAi](/products/senseai/) attaches magnetically in seconds and calibrates in under five minutes, with no wiring and no connection to the PLC. On plant Wi-Fi instead, it needs 2.4 GHz and outbound HTTPS on port 443.

[Sorinex](/customers/sorinex-exercise-equipment/) installed SenseAi sensors across its critical production equipment in under 5 days. At [Hugo Benzing](/customers/hugo-benzing/), it took under two weeks from kickoff to planning live in the Production Scheduler.

## Your week-one checklist

1. **Walk the floor with a phone.** Check cellular signal where a router could sit, and Wi-Fi signal at each mount point, before you order anything.
2. **Pick the path and send the note.** Choose plant Wi-Fi, a guest network or a cellular router, and send the one-page note to IT or the owner.
3. **Set shifts and the timezone.** Enter the real shift start and end times before the first sensor reports, so the first day's numbers land in the right shift.
4. **Connect one machine end to end.** Mount and connect the first sensor, and confirm it reads online from where it's mounted, not from the bench.
5. **Mount the rest of the line.** Connect every machine on the first line, and check each one reads running when it cuts and stopped when it idles.
6. **Name the Monday device check.** Give one person, often the maintenance lead, a weekly look at every device for anything offline.

What the first weeks should prove is a separate question, and [planning a monitoring pilot](/blog/monitoring-pilot/) answers it. For the phase-by-phase sequence after week one, follow the [rollout plan](/docs/get-started/roll-out-plan/#phase-1).

## Questions

### Will a cellular router slow down the plant's internet?

No. A cellular router carries the sensors' traffic over its own mobile data connection, so it never uses the plant's internet line or its Wi-Fi. Office computers, the ERP and anything else on the plant network see no extra load, because the sensors never join that network in the first place.

### Can we move the sensors from a cellular router to plant Wi-Fi later?

Yes. The sensors stay mounted where they are and only their network changes. You can start on cellular so the rollout doesn't wait on a review, then move to plant Wi-Fi once IT has approved the devices. Or stay on cellular for good, because it keeps the sensors off the plant network entirely.

### What if the building has weak cellular signal?

Walk the floor with a phone and look for a spot near a window or an exterior wall, high up and out of any metal cabinet, where the phone gets a usable signal. If no spot near the machines works, use a guest or separate Wi-Fi network instead, or place the router where the signal is and check how far its Wi-Fi reaches.

### Do we need IT approval to connect a PLC later?

Usually, yes. A controller connection puts a device on the machine's control and often on the plant network, which is a security concern for many plants, so IT usually reviews it first. Plan it as its own project, scoped to the machines and signals that need it, and keep sensors on the rest of the floor.

## Sources

1. [Facts About Manufacturing](https://nam.org/mfgdata/facts-about-manufacturing-expanded/), National Association of Manufacturers, from U.S. Census Bureau Statistics of U.S. Businesses, accessed Oct 30, 2026
2. [SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf), National Institute of Standards and Technology, accessed Oct 30, 2026
3. [MEP National Network](https://www.nist.gov/mep/mep-national-network), National Institute of Standards and Technology, accessed Oct 30, 2026