Cloud vs. On-Premise SCADA: A Decision-Making Guide for French Manufacturers, 2026

June 19, 2026 · 14 min read

14 min read

IoT Infrastructure

Cloud or on-premises? That’s the question most industrial automation managers and CIOs are asking themselves today. SCADA monitoring is evolving: SaaS cloud solutions are gaining ground over traditional on-premises installations, but the choice isn’t always clear-cut.

This guide objectively compares the two architectures based on seven key criteria—total cost, security, latency, scalability, compliance, maintainability, and resilience—to help you make the right decision based on your industrial context.

What We're Comparing

On-premises (traditional) SCADA: Physical server(s) installed on your premises or in your server room. SCADA software installed locally (Wonderware InTouch/System Platform, Ignition, PCVue, WinCC). Data history stored on a local SQL server. Access via the local area network (LAN) or via VPN for remote access.

Cloud-based SCADA / IIoT SaaS: A platform hosted in the cloud (AWS, Azure, GCP, or a French sovereign cloud). On-site industrial gateways that collect field data and send it to the cloud. Dashboard accessible from any browser. Historical data stored in the cloud. Examples: Eziwan, Axonize, Samsara, Siemens MindSphere, AWS IoT SiteWise.

Criterion 1: Total Cost of Ownership (TCO over 3 years)

On-Premises SCADA — Typical TCO for 10 Industrial Sites

Item	Cost (3 years)
SCADA software licenses (Wonderware System Platform, 10 connections)	45,000 – 80,000 €
Physical servers (2 redundant servers)	18,000 – 30,000 €
Network infrastructure (managed switches, routers)	8,000 – 15,000 €
Installation and configuration (system integrator)	20,000 – 40,000 €
Annual maintenance and support (15–20% of the license cost)	€20,000 – €45,000
Major updates (1 version every 3 years)	€15,000 – €25,000
Internal IT resources (administration, backups)	15,000 – 30,000 €
3-Year Total	141,000 – 265,000 €

Cloud-Based SCADA SaaS — Typical TCO for 10 Industrial Sites

Item	Cost (3 years)
Cloud platform subscription (10 sites, 500 data points)	18,000 – 36,000 €
Industrial gateways (1 per site × 10)	8,000 – 15,000 €
Installation and commissioning (simpler)	5,000 – 15,000 €
4G/M2M SIM connectivity (if no fiber)	3,600 – 7,200 €
Team training	2,000 – 5,000 €
3-Year Total	36,600 – 78,200 €

TCO Verdict: SaaS cloud solutions are 2 to 4 times cheaper over a 3-year period for multi-site deployments. The cost advantage increases as the number of sites grows. For a single site with an existing SCADA system that has already been amortized, an on-premises solution may still be a viable option.

Criterion 2: Safety

This is often the main argument put forward by advocates of on-premises solutions. Let's take a closer look at what's actually true.

What's true for on-premises solutions:

Data is physically located on your premises — no data is transmitted outside your premises
No reliance on a third party for data access
Possible isolation from the Internet (air gap)

Common misconceptions about on-premises systems:

"On-premises = more secure" — false in most cases. SMEs generally do not have a dedicated cybersecurity team. Their on-premises servers often run on unpatched Windows Server 2012/2016, without access monitoring or intrusion detection. An ISO 27001-certified cloud provider with a dedicated security team is generally more secure than an unmonitored server in a machine room.
"My data never leaves the facility" — true only if you have actually isolated the SCADA server. If you access the SCADA system from the Internet (RDP, VPN), the data is still transmitted.

What the cloud offers:

ISO 27001-certified hosting with a 24/7 security team
Encryption in transit and at rest (TLS 1.3, AES-256)
Automatic security updates — no unpatched CVEs for 3 years
Native MFA authentication for all access
Comprehensive, centralized audit logs

The following are real cloud risks:

Internet availability — if the Internet connection goes down, you lose access to the remote SCADA system (but not local control, which remains on the PLCs)
Sovereign data compliance — if you process sensitive data (OIV, personal data), the choice of cloud provider is critical (France vs. the U.S.)

Security Verdict: At the same level of maturity, an ISO 27001-certified cloud hosted in France is generally more secure than an unmanaged on-premises solution. For OIVs (Operators of Vital Importance) or highly sensitive sectors, the French sovereign cloud (ANSSI-certified SecNumCloud) is recommended.

Criterion 3: Latency and Real Time

The Truth About Cloud Latency

The round-trip latency between a field gateway and a cloud server hosted in Paris ranges from 50 to 200 ms, depending on the quality of the 4G or fiber connection.

Is this acceptable for your application?

Application	Required Latency	Cloud OK?
PLC control loop (PID)	1–10 ms	❌ No — remains on the local PLC
Motion control	1–5 ms	❌ No — remains on the drive/servo
Safety alarms (SIL, PLe)	10–100 ms	❌ No — remains on the safety PLC
Machine status monitoring	100 ms–1 s	✅ Yes
Alerts and notifications	1–30 s	✅ Yes
Production dashboards	1 – 60 s	✅ Yes
Reports and history	No time constraints	✅ Yes
Remote maintenance (VNC/SSH)	50 – 500 ms	✅ Yes (acceptable)

Golden Rule: Real-time control ALWAYS remains on the local PLC. The cloud handles monitoring, alerts, historical data, and remote maintenance. This separation of responsibilities is the key to a proper IIoT architecture.

Latency Verdict: Cloud latency is perfectly acceptable for 95% of industrial monitoring scenarios. Only the real-time control loop must remain local.

Criterion 4: Scalability

On-premises: Scalability Is Difficult and Costly

Scaling from 10 to 50 on-premises monitored sites requires:

Additional servers (or memory/storage upgrades)
Additional licenses (often prorated based on the number of tags or connections)
Assistance from an integrator for configuration
Migration of historical data
Testing and validation before going live

Typical turnaround time: 4 to 12 weeks. High marginal cost.

Cloud: Nearly Instant Scalability

Add a new SaaS cloud site:

Order a gateway (delivered in 5–7 days)
Install it and connect it to the site’s OT network (30–60 minutes)
Configure the data points from the web dashboard
The site appears in the centralized dashboard—immediately

Typical lead time: 1 to 2 weeks (determined primarily by hardware availability). Low marginal cost.

Scalability verdict: The cloud wins by a wide margin. This is particularly crucial for multi-site deployments or system integrators that manage portfolios ranging from several dozen to several hundred client sites.

Criterion 5: Compliance and Regulation

NIS2 (European Cybersecurity Directive)

For essential and important entities subject to NIS2 (water, energy, critical industries), the cybersecurity requirements are the same regardless of the architecture. The difference lies in the ability to demonstrate compliance:

On-premises: You are responsible for the entire chain (OS, application, network, access). The NIS2 audit will review your logs, update procedures, and network segmentation.
Certified cloud: The ISO 27001-certified cloud provider covers part of the requirements (infrastructure, hosting). You remain responsible for application configuration and user access.

If your SCADA system processes personal data (operator attendance records, biometric access), the location of the data is important:

EU Cloud (AWS Paris, OVHCloud): GDPR-compliant if the contract includes the appropriate DPA clauses
US Cloud (without SCCs): non-compliant for personal data of European citizens
On-premises in France: compliant by nature if access is properly controlled

Regulated Industries (Pharmaceuticals, Agri-Food)

FDA 21 CFR Part 11 (electronic traceability in the pharmaceutical industry) and EU GMP Annex 11 are compatible with the cloud, provided you choose a service provider that can supply the validation certificates (IQ/OQ/PQ) required by auditors.

Compliance Verdict: The cloud, hosted in France by an ISO 27001-certified provider, is compliant with NIS2, the GDPR, and major industry regulations. Check the provider’s certifications.

Criterion 6: Maintainability

On-premises: The Hidden IT Burden

Manufacturers often underestimate the maintenance burden of an on-premises SCADA system:

OS updates (monthly Windows Server patches)
Antivirus updates (daily)
Backup management and restore testing
SQL database updates (PostgreSQL, MS SQL)
SSL certificate renewal
License management (renewal, Microsoft audit)
Internal user support

In practice, an on-premises SCADA system requires 0.3 to 0.5 IT FTEs over the course of its lifecycle (shared with other systems).

Cloud: Outsourced Maintenance

On a SaaS cloud platform, the provider manages:

The entire infrastructure (servers, network, storage)
Security updates (without service interruption)
Backups (contractually guaranteed RTO/RPO)
Infrastructure scalability based on workload

Your team only maintains the field gateways (with automatable OTA firmware updates) and the application configuration.

Maintainability Assessment: The cloud reduces the operational burden by 70–80%. This is crucial for small and medium-sized businesses without a dedicated IT team.

Criterion 7: Resilience and Availability

On-premises: A Double-Edged Sword in Terms of Resilience

Key Features:

Works even when the Internet is down (continuous local monitoring)
No reliance on a third party for local access

Weaknesses:

Server failure = complete shutdown of monitoring
Requires hardware redundancy for high availability (doubles the cost)
Complex disaster recovery (server reconstruction)
Actual SLA is often poor (99% = 3.65 days of downtime per year)

Cloud: High Availability by Design

Reputable industrial cloud platforms guarantee 99.9% availability (contractual SLA = < 8.76 hours of downtime per year) or even 99.95%.

Multi-AZ (multi-datacenter) architecture: A failure in one datacenter does not affect service. Disaster recovery (DR) is automatic.

Main cloud risk: If the site’s Internet/4G connection is lost, the gateway loses its connection to the cloud. Data is buffered locally (store-and-forward) and retransmitted once the connection is restored. Remote monitoring is unavailable during the outage.

Answer: For critical sites, deploy a backup connection (dual-operator 4G SIM with failover to fiber, or satellite VSAT as a last resort).

Resilience verdict: The cloud offers better platform availability. On-premises solutions are more resilient for local monitoring without network dependencies. A hybrid approach (local control + cloud monitoring) offers the best of both worlds.

Hybrid Architecture: The Best of Both Worlds

Most new industrial deployments adopt a hybrid architecture:

Advantages of the hybrid solution:

Critical controls and alarms remain local (zero latency)
Monitoring, history, and remote access are in the cloud
In the event of an Internet outage, the process continues (PLC) and data is buffered (gateway)
Edge intelligence (local automation rules) reduces dependence on the cloud

This is exactly the architecture that Eziwan deploys: an industrial gateway at each site (edge), and a cloud platform for centralized monitoring.

Summary Table

Criterion	On-premises	SaaS Cloud	Hybrid
3-Year TCO (10 sites)	141–265 k€	37–78 k€	50–100 k€
Security	Depends on your IT	ISO 27001	ISO 27001 + OT isolation
Control latency	Excellent	Not applicable	Excellent (local)
Monitoring latency	Excellent	50–200 ms	50–200 ms
Scalability	Difficult	Easy	Easy
Maintainability	IT workload: 0.3–0.5 FTE	Minimal	Minimal
Platform availability	~99% (if redundant)	99.9%+ (SLA)	99.9%+
Resilience to Internet Outages	Full	Limited	Good (store-and-forward)
NIS2/GDPR Compliance	Possible	Possible	Possible
Deployment Time	4–12 weeks	1–2 weeks	1–2 weeks

When to Choose What?

Choose the SaaS cloud if:

You manage multiple sites (3+) and want centralized monitoring
You don’t have a dedicated IT team to maintain servers
You’re deploying a new solution (greenfield) without legacy SCADA
Your budget is limited and you’re looking to minimize capital expenditures
You need high-quality remote access for your technicians or contractors

Choose the on-premises option if:

You have a recent, existing SCADA system that has already been fully depreciated (Wonderware, Ignition)
You are an OIV and have strict network isolation requirements
You have an in-house IT team capable of maintaining the infrastructure
Your site is a single location with no need for multi-site monitoring
Your latency requirements are extremely strict (real-time critical < 10 ms)

Choose the hybrid option if:

You have an existing SCADA system that you want to supplement with remote access
You want the best ROI without overhauling your on-premises SCADA architecture
Your process requires local control but you want cloud-based monitoring
This is the most common scenario for new IIoT projects

Conclusion

There is no one-size-fits-all answer. The choice depends on the number of your sites, your IT maturity, your regulatory requirements, and your scalability goals.

One thing is certain: for multi-site deployments, the TCO balance clearly favors the SaaS cloud. And the security argument only holds water if your on-premises infrastructure is properly maintained—which is rarely the case in small and medium-sized businesses without a dedicated cybersecurity team.

The hybrid edge-and-cloud architecture, exemplified by solutions such as Eziwan, now makes it possible to combine local control (zero latency, offline operation) with the power of the cloud (centralized monitoring, remote access, unlimited history)—without having to choose between them.

FAQ

Can a cloud-based SCADA system operate if the Internet is down? With a hybrid architecture (edge gateway + cloud), the industrial process continues to operate (the PLC runs autonomously), and data is buffered locally by the gateway (store-and-forward). Real-time monitoring is interrupted during the outage, but the data is not lost—it is transmitted as soon as the connection is restored. For critical alarms, configure local alerts (relays, SMS messages from the edge gateway) that function without an Internet connection.

Which on-premises SCADA systems are compatible with a cloud-based IoT gateway? Wonderware AVEVA, Ignition (Inductive Automation), CODESYS, FactoryTalk (Rockwell), WinCC (Siemens), Citect—all integrate with cloud-based IoT gateways via OPC-UA, Modbus TCP, or REST APIs. The hybrid architecture involves letting the on-premises SCADA system handle local control and adding a cloud-based IoT gateway for remote monitoring and technician access.

Is SaaS cloud computing suitable for trade secrets (formulas, proprietary processes)? Critical process data (recipes, proprietary parameters) can be excluded from cloud transmission—you only send what you need for monitoring (temperatures, pressures, machine statuses). For the most sensitive data, cloud hosting in France (OVHCloud, Scaleway), which is subject to French law, offers an additional level of protection compared to U.S. hosting providers subject to the CLOUD Act.

How long does it take to migrate from an on-premises SCADA system to the cloud? For a site with an existing SCADA system, deploying a cloud layer (remote access, multi-site monitoring) takes 1 to 4 weeks without disrupting the on-premises SCADA system. The existing SCADA system remains in place; the cloud IoT gateway is added in parallel. A complete migration to a cloud-based SCADA system (without an on-premises SCADA system) takes 2 to 6 months, depending on the complexity of the installation.

Additional Resources

Cloud SCADA — cloud-based SCADA platform for centralized industrial monitoring
Industrial Monitoring and Remote Support — remote monitoring solutions for industry
Industrial edge computing — local data processing to reduce reliance on the cloud
Guide: 4G SCADA Architecture — designing a SCADA architecture with 4G connectivity

Cloud vs. On-Premise SCADA: A Decision-Making Guide for French Manufacturers, 2026

What We're Comparing

Criterion 1: Total Cost of Ownership (TCO over 3 years)

On-Premises SCADA — Typical TCO for 10 Industrial Sites

Cloud-Based SCADA SaaS — Typical TCO for 10 Industrial Sites