SIB GmbH put 44 Linux shop floor terminals under management and closed its TISAX findings

The MES vendor releases a client update four or five times a year. Each one meant a walk through the hall. The IT specialist copied the update to a USB stick and went from terminal to terminal, waiting at each one for the operator to finish booking the current job.

“Then she walks the hall. In safety shoes, because it’s production.”

Markus Brenner, Leiter IT (Head of IT)

Each terminal took 10 to 15 minutes of hands on work. With the waiting, a full round took 1.5 to 2 working days. When the grinding department ran a long batch, she came back on the next shift. While she was in the hall, every other ticket went to the Head of IT.

Ubuntu security updates meant the same walk, with the added risk of breaking the MES client and stopping a machine from booking. After one bad experience in 2022, the team stopped patching the terminals altogether.

The risk was real. In February 2025, an MES update changed how the client connected to the database. The first 14 terminals looked fine after the update, but their bookings never reached production planning. Nobody noticed until the afternoon. The team rolled the terminals back by hand until the evening. Operators wrote their bookings on the backs of job sheets, and the production planner typed in about 400 of them over the next 2 days.

The rest of the fleet ran on manual work too. The inventory was a spreadsheet that listed each terminal’s machine number but not its operating system version. iPhones were set up by hand. The external service provider’s technicians shared one domain admin account. When a laptop failed in Dubai, it went back to Villingen by courier, and the engineer spent 2 weeks without it.

In spring 2025, one of SIB’s largest customers, a company in the automotive supply chain, set a new rule. From 2026, every supplier receiving its drawings needed a TISAX label at assessment level 2. The first assessment in September 2025 raised three major findings, all in IT: no complete inventory including production IT, no evidence of patch management for production IT, and no enforced encryption or passcodes on phones. A minor finding covered the shared admin account. Without the label by the end of the first quarter of 2026, SIB would get no new drawing projects from that customer.

“He pointed at a terminal and said, how many of these do you have and what’s running on them. I said forty four. And I didn’t know the rest.”

Markus Brenner, Leiter IT (Head of IT)

NIS2 added pressure in the background. SIB’s lawyer advised that the company is probably in scope as an important entity, and SIB registered with the BSI in February 2026.

An MES client update used to take 1.5 to 2 working days of walking the hall. In June 2026, the IT specialist pushed an update from home on a Saturday morning, and 42 of 44 terminals had it within about 40 minutes. The last 2 were inside a machine under repair and updated the next working day.

Linux patch status was unknown, and 17 of 44 terminals turned out to be on Ubuntu 18.04. In August 2026, all 44 were on Ubuntu 24.04 and current on weekly security updates.

Windows patch status was also unknown. In August 2026, 69 of 71 Windows devices were patched within 14 days of Patch Tuesday. The other 2 are the documented measuring PC exception.

The follow up TISAX assessment in February 2026 closed all three major findings and the minor one. SIB received its assessment level 2 label in March 2026, about 2 weeks before the customer’s deadline. Preparing evidence for the first assessment took two people about 3 weeks of evenings. For the follow up it took about 2 days. The same reports now feed SIB’s NIS2 risk documentation.

Setting up an iPhone took about 40 minutes by hand. On 1 September 2026, nine new apprentices switched on phones still in the box, and IT spent about 5 minutes with each. All nine were set up in one morning.

A leaver’s phone used to sit in a drawer for 2 to 3 weeks with mail still on it. For the six leavers since February 2026, the phone was wiped the same day, usually within an hour of HR’s email.

Laptops shipped back from Dubai for repair fell from 4 in 2025 to 1 so far in 2026, and that one had a broken screen. The IT specialist now fixes the rest remotely, with the engineer accepting the session prompt.

Two changes came without planning. The rugged tablets at the machines, bought for viewing drawings, now run only the drawing viewer and the quality app after reports of unrelated use on night shifts. Operators say drawings open faster than before. The team also estimates it gets back about 8 hours a week between two people, and the IT specialist now spends that time separating the production network from the office network.