OT maintenance windows: closing is the hard part

Open is easy. There is a clear trigger — a vendor needs access, a backup job needs to start, a patch needs to deploy. The trigger arrives, someone opens the path, work happens.

Close is hard. The trigger that closed the maintenance window in theory — work finished, ticket resolved, vendor confirmed disconnect — is not a hard signal. It is a soft signal that someone has to act on. In retrospectives, the gap between the work ending and the path being closed is where most of the residual exposure lives.

The operational pattern that survives is one where the close is a property of the open command, not a follow-up action. The window has a duration when it opens. The relay's own timer counts down. When the timer expires, the line is mechanically broken — there is no operator step in between.

This means the open command needs to commit to a duration. 90 minutes for a routine vendor service call. Six hours for a quarterly maintenance day. Two hours for the nightly backup window. The exact numbers depend on the path; the design is that the number is fixed at open time, not negotiated at close time.

A typical mid-sized OT site running this pattern has somewhere between 5 and 15 controlled lines. Each line has its own schedule. A backup-target line opens nightly at 22:00 for 90 minutes. A vendor maintenance line for a PLC opens on the 1st Tuesday of the month for 6 hours. An update channel to a controller opens during the monthly patch window. An emergency line for one critical pump opens on-demand by the on-call operator's SMS, with a 2-hour cap.

Across all of these, the operator's interaction is the open command and the schedule definition. The close runs on the device. The auditor reads the device log against the schedule definition. The retrospective questions become 'was the schedule correct' rather than 'was the path cleaned up'.

Two operational considerations. First, scheduling drift — if the routine vendor work is taking longer than the scheduled 90 minutes, the right response is to lengthen the schedule, not to extend the window in-band. Letting operators learn to call the relay-open during work normalises the soft close.

Second, emergency windows. Real environments need a way to open a maintenance window outside of schedule for genuinely urgent work. The right shape is a documented procedure that opens a time-capped emergency window — same physical mechanism, just initiated by the on-call's SMS instead of the scheduler. The log records the emergency open the same way it records a scheduled one.