Querétaro Aerospace Cluster: The IT Needs of Franco-Mexican Manufacturing

Querétaro: The Meeting Point Between the French Aerospace Industry and Mexico

When people talk about French subsidiaries in Mexico, the conversation usually centers on trade or services. But the most visible—and longest-standing—example is in high-precision manufacturing: the Querétaro aerospace cluster.

Safran, the French aerospace and defense group, set up operations in Querétaro in 2006. Twenty years later, it operates six plants in the state —out of a total of eleven throughout Mexico—and is, according to its own figures, the largest employer in Mexico’s aerospace industry, with nearly 6,000 employees in the country. In February 2026, the company announced a new plant that will create 1,200 additional jobs to manufacture next-generation engine components.

Safran is not alone. Querétaro is now home to 80 established aerospace companies —including Bombardier, Airbus, and ITP Aero—and, following the July 2026 Farnborough Airshow, 50 more companies expressed interest in setting up operations in the state. The sector already generates nearly 20,000 high-value jobs and positions Querétaro as one of Mexico’s four leading aerospace clusters.

Behind these figures lies an operational reality that is rarely discussed: the IT infrastructure of an aerospace plant is nothing like that of a service office, and the sector’s French subsidiaries face specific requirements that their parent company in France takes for granted—and that, 9,000 kilometers away, someone in Mexico has to ensure are met.

Why Industrial and Aerospace IT Is Different

Three factors distinguish the IT infrastructure of an aerospace plant from that of any other subsidiary:

• OT/IT Convergence. Today, CNC machines, SCADA systems, and automated assembly lines share the same network as corporate servers. A cybersecurity incident is no longer just a data issue—it can bring a production line to a halt.
• Intellectual property of immense value. The blueprints, tolerances, and technical specifications for a CFM56 engine component or a landing gear are, quite literally, trade secrets. The aerospace industry is one of the most sought-after targets of industrial espionage—and an overseas subcontractor’s facility is often the most vulnerable link in the chain.
• European regulations that continue to apply outside Europe. The European Union’s NIS2 cybersecurity directive may extend reporting obligations and minimum control requirements to subsidiaries of a French parent company when they are part of its critical supply chain—even if those subsidiaries operate in Mexico.

None of these three issues can be resolved by a generic help desk. They require an IT architecture designed for an industrial environment, not an office setting.

Multiple Plants, a Single Architecture

With six Safran plants in Querétaro alone—and potentially dozens more French suppliers in the same cluster—managing IT on a plant-by-plant basis multiplies the risk rather than reducing it: each site has its own access policy, its own patching procedures, and its own visibility (or lack thereof) into what is happening on the network.

In practice, the opposite is true: a centralized architecture with:

• Clear separation between the OT network (plant) and the IT network (corporate), with auditable control points between the two.
• Site-to-site connectivity between facilities, rather than ad hoc connections on a facility-by-facility basis.
• A single security operations center (SOC) with visibility across all sites, not a patchwork of on-premises solutions.
• Coordinated patch management — patching a production machine is not the same as patching an office laptop; it requires maintenance windows planned in coordination with the industrial division.

Checklist for the IT Manager of a French Aerospace Subsidiary in Mexico

• Is there a real separation (not just on paper) between the OT network and the IT network at each plant?
• Who has remote access to industrial control systems, and what authentication methods are used?
• Are the drawings and technical specifications shared via encrypted channels with version control, or are they circulated via email?
• Does the parent company in France know what NIS2 requires of this Mexican subsidiary—or has the issue never even been raised?
• Is there a specific business continuity plan for a network outage that affects the production line, separate from the office business continuity plan?

The same differentiator, a more demanding sector

Keptos It already supports French and European subsidiaries in Mexico with IT management, cybersecurity, and auditing—with language, time zone, and the dual compliance framework (Mexican and European) addressed from day one. The aerospace sector simply raises the bar: more segmentation, more traceability, and stricter patch management. It’s exactly the kind of environment where a generic help desk isn’t enough—and where an industrial IT audit is well worth the investment before an incident forces you to conduct one on an emergency basis.

Learn more about our cybersecurity solutions for businesses in Mexico, our IT audits, or how we manage IT for multi-site subsidiaries on our IT management page. And if you’d like to see how we address the challenges faced by other French subsidiaries in Mexico, you can read our article on how to remotely manage the IT of a French subsidiary.