Cloud, plant-hosted or hybrid MES?

Choose an MES deployment model by testing responsibility, connectivity and recovery requirements. Cloud, plant-hosted and hybrid designs describe where some components run; none of those labels proves that the plant can continue safely through an outage.

Map the execution path

Draw the path from a released order to the operator screen, machine or scanner, then to the recorded completion. Mark where identity checks, work instructions, material checks and quality decisions occur. A cloud application may still depend on a local gateway. A plant-hosted application may still depend on remote identity, licensing or supplier support.

For each dependency, ask what the workstation does when it disappears. Can an operator finish an already started task? Can the next order begin? Are quality holds still enforced? Record the answer by workflow rather than assuming that an offline label applies to the entire application. This map becomes the foundation of an outage test.

Compare responsibility, not just hosting fees

Model	Local work that may remain	Question to resolve
Cloud-managed	Edge services, networks, terminals	Who patches the gateway and monitors queues?
Plant-hosted	Servers, database, backup, application	Who can restore the full stack on a night shift?
Hybrid	Local execution and remote services	How are local and remote records reconciled?

Ask for a responsibility matrix covering operating systems, application updates, certificates, identity, backups, restore tests and incident communication. Hosting can shift tasks between organizations without eliminating them. Make the contractual boundary explicit, including subcontractors and support escalation. A promised service availability percentage is not a complete description of what happens to production during a failure.

Test a disconnected shift

Use a controlled test environment with representative orders and material. Disconnect the intended network dependency under an approved test plan. Observe the screens and record whether existing work can finish, new work can start, and local data remains durable. Do not interrupt live controls merely to test a business application.

Reconnect and examine event replay. Send a completion twice, change a quality disposition upstream and introduce a delayed event. Verify that accepted quantities and material records agree across systems. The purpose is to identify the supported outage envelope and operating restrictions. A successful short disconnection does not establish that a full shift, a device restart or a full local disk is supported.

Compare the whole ownership boundary

Include local infrastructure and labor even when the application is sold as a service. For a plant-hosted option, include backup administration, restore exercises, monitoring, maintenance windows and the people available to operate the system. For a cloud option, include local connectivity, edge support, export or retention charges where the proposal specifies them.

As an illustrative comparison method, put each model through the same five-year ledger with identical user, site and record assumptions. Do not fill unknown costs with invented market rates. Ask the supplier for a written answer or keep an explicit allowance. Cost may change after a second plant, an additional test environment or a larger retention requirement is added.

Treat data access and release cadence as design inputs

Ask how the plant obtains usable records outside the application. Determine whether an export includes relationships, attachments, audit context and configuration versions. Schedule and volume limits matter if another system depends on the data. Confirm whether access continues during a commercial dispute or after termination, with legal advice where appropriate.

Discuss application changes as well. A supplier-managed release still needs plant-side preparation when workflows, interfaces or training are affected. Ask for test access, release notes, advance notice and an escalation path for a blocking defect. In a regulated use, have quality personnel decide how changes are assessed and evidenced. Hosting does not decide that obligation for you.

Record the architecture decision

Write a short architecture record stating the chosen model, the workflow it supports, the alternatives considered and the evidence behind the choice. Include known limitations, such as work that must stop during a WAN outage, and the approved manual alternative. Make it clear who may approve a change to those assumptions.

Return to the decision when the site adds a production line, a new identity service or an acquisition with a different network. The original design may remain valid, but it should not be accepted by habit. A production team should be able to explain where execution depends on remote services and who is responsible when those dependencies fail.

FAQ

Is cloud always cheaper?

No general conclusion follows from the label. Compare the same scope, operating responsibilities and planning horizon using actual proposals.

Does local hosting guarantee offline execution?

No. Remote identity, licensing or upstream data may still be required. Test the complete workflow and its dependencies.

Who should choose the model?

Production, IT, OT, security, quality and procurement should resolve their requirements together. The decision needs an accountable architecture and operating owner.

Continue your decision

Use the mes ownership cost to document your own inputs. Compare operating models on the comparison page.

Sources and scope

NIST SP 800-82 Rev. 3 — Official OT security guidance. The page distinguishes the final revision from newer draft work; check status before use. Our test scenarios are editorial examples.

Examples are hypothetical and are not measured customer results, supplier quotations, or evidence of professional review. Prepared on October 30, 2026; confirm current requirements with the relevant official body and your responsible specialists.