Manufacturing and industrial

That is a normal and legitimate constraint. Machine controllers are frequently validated against a specific operating system version and updating them voids support or breaks the machine. The answer is not to update it, it is to isolate it: a restricted network segment that limits what the controller can reach and what can reach it, with vendor remote access scoped to that segment alone. The unpatched system remains, but the exposure is contained and documented as a compensating control.

If the plant network is flat, yes, and this is how manufacturing incidents typically escalate. The initial compromise is nearly always in the office environment, through email or a credential. What determines whether it becomes a production shutdown is whether anything stops it travelling from a desk to a machine. Segmentation does not prevent the initial event. It decides whether the event costs you a workstation or a week of output.

It usually does, and the requirements flow down whether or not you contract with the government directly. If a prime sends you controlled technical data, obligations attach to how you handle it. Pierce County has a dense supplier base around Joint Base Lewis McChord and this catches out a lot of machine shops. The first step is asking your primes in writing what flows down to you, because scoping this correctly is what determines the cost of everything after it.

Office systems are maintained on a normal cycle. Anything touching production is scheduled around shift patterns, staged one cell or line at a time, and done with the machine vendor reachable where their software is involved. Where a plant runs continuously, that usually means planned changes during a scheduled shutdown rather than a weekly window, which makes the annual maintenance calendar a genuinely important document.