Maintenance laptop quarantine

Two ways to connect a vendor laptop: plugged into a production switch, where it can reach every PLC on that switch and move laterally, versus a dedicated maintenance access port behind an OT firewall that enforces an approved work order, laptop posture check, a single target PLC, required protocols only and an approved time window.