Factories are placing increasing demands on network connections within their facilities. Partly due to the growing threat of cybersecurity attacks, and partly because regulations require them to implement stricter access controls.

When machines are delivered, an IXON edge gateway is often included by default to enable optimal remote service. However, this means the factory has no control over the remote connection.

The Oversight feature (formerly Cross-Org Audit) allows factories to obtain audit rights over the edge gateway of a machine builder. Once obtained, audit rights cannot be revoked by the machine builder themselves. They can only be returned by the factory. In practice, this means that when the machine builder grants audit rights to the factory, the factory is enabled to:

• Enforce approval for VPN or EasyControl.
  • Meaning if the machine builder wishes to connect, the factory first needs to approve the request.
• Block configuration push, firmware update, or device reboot.
  • Meaning the machine builder cannot push configuration changes from the IXON Cloud, or update the firmware, or reboot the device. All these steps can interrupt machine operations, depending on how everything is configured and connected.
• View the device event log.
  • This is a log of which users have been connected to the IXON edge gateway.
• View the device configuration.

See below for instructions.

• For machine builders
• For factories
• How to return control to the machine builder

For machine builders

The IXON edge gateway will remain in the machine builder's IXON Cloud company. Additionally, it'll be added to the factory's IXON Cloud company with limited functionality (see the introduction of this support article for more information).

1. Go to your own IXON Cloud company.
2. Go to Fleet Manager > Devices and click on your device name.
3. In the left menu, go to Info.
4. Under Ownership, at Grant device control, request a control key.
5. Copy the device ID and control key. You will need to send this to the factory.
   • Audit rights cannot be revoked by the machine builder. They can only be returned by the factory.

For factories

The IXON edge gateway will remain in the machine builder's IXON Cloud company. Additionally, it'll be added to the factory's IXON Cloud company with limited functionality (see the introduction of this support article for more information).

1. Go to your own separate IXON Cloud company.
2. Go to Fleet Manager > Devices under audit and click on Add new device.
3. Enter a name, enter the device ID and control key received from the machine builder, and click on Add.
   • The name can be different from and is unrelated to the device's name in the root company.
   • Audit rights cannot be revoked by the machine builder. They can only be returned by the factory.

The device is now under audit in your IXON Cloud company. You can proceed below to configure that the machine builder needs to request approval before they can connect using VPN or EasyControl. This essentially works the same as Access request and approval, with the difference being that the machine builder cannot turn this off and that the approvers are in the factory's IXON Cloud company. Additionally, you can also block the machine builder's ability to do a configuration push, firmware update, or device reboot, which can all interrupt machine operations, depending on how everything is configured and connected.

4. Assign an approver. Select which applies to you:

5. Go to Fleet Manager > Devices under audit and click on the device name.
6. Go to Info.
7. Under Lock, enable the desired options.
   

   Option	Description
   Enforce approval for VPN connections	This prevents the machine builder from establishing a VPN connection without the factory's explicit approval. This essentially works the same as Access request and approval, with the difference being that the machine builder cannot turn this off and that the approvers are in the factory's IXON Cloud company.
   Enforce approval for EasyControl	This prevents the machine builder from establishing an EasyControl connection without the factory's explicit approval. This essentially works the same as Access request and approval, with the difference being that the machine builder cannot turn this off and that the approvers are in the factory's IXON Cloud company.
   Block config push	This prevents the machine builder from pushing configuration changes to the edge gateway. Depending on how the machine is configured and connected, performing a config push could interrupt machine operations.
   Block firmware update	This prevents the machine builder from updating the firmware of the edge gateway. Depending on how the machine is configured and connected, performing a firmware update could interrupt machine operations.
   Block device reboot	This prevents the machine builder from rebooting the edge gateway. Depending on how the machine is configured and connected, performing a device reboot could interrupt machine operations.

How to return control to the machine builder

Audit rights cannot be revoked by the machine builder themselves. They can only be returned by the factory.

1. Go to the factory's IXON Cloud company.
2. Go to Fleet Manager > Devices under audit and click on the device name.
3. Go to Info.
4. At Remove and return control, click on Remove.
   • This will return control back to the machine builder and will fully remove the device from the factory's IXON Cloud company.