“The cloud is only monitoring” is rarely a complete sentence

The phrase arrives in kick-off meetings as a comfort. Cameras, energy meters, and vibration sensors truly can be one-way. Control applications that started as one-way rarely stay that way.

A year later someone wants to reset a fault without climbing a mezzanine. Someone wants to change a schedule from home during a public holiday. The vendor ships a “command module” that uses the same device certificate as telemetry. The ACL on the broker is still # because that is how the proof of concept was built.

We treat marketing labels as out of scope. In scope: which topics accept payloads, which cloud functions can invoke a device method, and whether a compromised dashboard user can reach those methods. If the answer is yes, the application is a control system that happens to be hosted elsewhere.

That does not mean every site must pull the cloud out. It means the same questions you would ask of a local SCADA write — authentication, authorisation, logging, dual control for high-impact actions — still apply. We write them down in ordinary language so operations and IT can argue about the same object.

All notes