Manufacturing Cybersecurity Programme Guide

Most manufacturers that stop production after a cyber attack do so because the IT systems that schedule, release and ship work are gone, not because a PLC was reprogrammed. That makes manufacturing security a production continuity problem first and a controller security problem second, and a programme has to cover both. This guide sets out how to build a plant-wide security programme: understanding the dependencies that turn an IT incident into a line stoppage, the threats that matter, a control baseline from the enterprise to the cell, the regulatory and customer pressures, monitoring, recovery and a phased rollout with metrics. It is written for manufacturing CISOs, plant and OT engineering leads and the IT teams that support them, for single-site SMEs as well as multinational groups.

Key takeaways

Map production dependencies before buying OT tools. ERP, MES, label printing, recipe servers and identity services decide whether a line can run; most stoppages come from losing them.
Ransomware in IT is the main production threat. Controller-level attacks are rare; encryption of shared Windows infrastructure and a precautionary shutdown are common, as the 2025 Jaguar Land Rover incident showed.
Design for islanded operation. Each plant should be able to keep producing, or shut down safely and restart quickly, with the corporate network cut off.
Treat integrators, OEMs and machine builders as part of the attack surface. Remote support paths, shared project files and USB-borne updates enter the plant outside normal IT controls.
Measure recovery, not just prevention. Time to restore MES and engineering systems from offline backups, and how long a plant can run islanded, are the metrics that predict business impact.

Why manufacturing programmes are different

CISA's Critical Manufacturing Sector groups four core industries: primary metals, machinery, electrical equipment and components, and transportation equipment. Across those and the wider discrete and process industries, the security problem has the same shape.

Tight coupling of IT and production: just-in-time and just-in-sequence supply means production orders, bills of materials and shipping labels flow from ERP through MES to the line every few minutes. Lose that flow and the line stops even if every controller is healthy.
Long asset life: PLCs, HMIs and CNC controllers run for 15 to 25 years; engineering workstations often run old operating systems because the engineering software requires them.
Many sites, uneven maturity: acquired plants arrive with their own networks, domains and vendors, and the weakest plant often connects to the same wide area network as the best.
Safety and quality obligations: changes need validation, and in regulated sectors (automotive, aerospace, pharmaceuticals, food) a change to a validated system creates paperwork that slows patching.
Supply chain exposure in both directions: an incident at a manufacturer stops its customers, and an incident at a tier 1 supplier stops the manufacturer.

The Manufacturing Identity and OT Access Guide covers the identity side in depth (shared HMI accounts, OEM access, engineer privilege); this guide covers the programme around it.

Mapping production dependencies

Run a dependency workshop per plant with production, maintenance, quality, logistics and IT. For each line, ask what stops it within one hour, one shift and one week if the system is lost. The answer drives segmentation, backup priority and the islanding design.

System	Typical location	If lost	Programme response
ERP (orders, materials, shipping)	Corporate data centre or cloud	No new orders or dispatch; line runs from buffer then stops	Local order buffer, documented manual dispatch, offline export of open orders
MES and quality systems	Plant data centre (Level 3)	No work instructions, traceability or release; regulated products cannot ship	Treat as Tier 0 for the plant: local hosting, offline backups, tested rebuild
Active Directory and DNS	Corporate, sometimes extended into OT	Logons to HMIs, MES and file shares fail	Separate plant or OT domain, local break-glass accounts, no trust to corporate
Recipe and program servers	Plant OT network	Changeovers impossible; batch processes cannot start	Version-controlled repository with offline copy
Engineering workstations	Plant OT network	No fault finding or program changes	Hardened, inventoried, with images and licence files backed up
Label and print servers	Often on the IT network	Products cannot be packed or shipped	Move into the plant zone or provide a local fallback
Historian and OEE dashboards	Level 3 with replication to IT	Reporting lost; production usually continues	Lower priority, but secure the replication path into IT

The Jaguar Land Rover cyberattack illustrates the stakes: the company proactively shut down its systems at the start of September 2025, a phased restart began on 8 October, and the Cyber Monitoring Centre estimated the UK cost at GBP 1.9 billion with more than 5,000 UK organisations affected. How the attackers entered has not been publicly disclosed, so the lesson is about dependency and recovery, not a specific technique.

Threats that matter to production

Threat	How it reaches production	ATT&CK	Primary controls
Ransomware and extortion in IT	Encrypts ERP, MES, file servers and shared AD; plant shut down as a precaution	T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery; ICS T0828 Loss of Productivity and Revenue	Segmentation, separate OT identity, immutable offline backups, islanding
Stolen credentials and remote access	VPN or remote desktop accounts without MFA, including supplier accounts	T1078 Valid Accounts, T1133 External Remote Services	Phishing-resistant MFA, brokered vendor access, account expiry
Removable media and transient devices	Engineer laptops and USB sticks carrying updates or malware into the cell	ICS T0847 Replication Through Removable Media	Managed transient devices, media scanning kiosks, USB control on HMIs
Project file and supply chain compromise	Infected PLC project files or vendor software updates	ICS T0873 Project File Infection, T0862 Supply Chain Compromise	Signed updates, hash checks, controlled project repository
Internet-exposed OT	HMIs, VNC and remote access gateways reachable from the internet	ICS T0883 Internet Accessible Device	External exposure scanning, removal from the internet
Intellectual property theft	CAD, recipes and process parameters exfiltrated from engineering shares	ICS T0882 Theft of Operational Information	Data classification, egress monitoring, engineering share access review

See the Ransomware Prevention Guide for the IT controls and the MITRE ATT&CK for ICS Guide for the OT technique model.

Control baseline from enterprise to cell

CISA, FBI, EPA and DOE give five primary OT mitigations that apply to every plant: remove OT from the public internet, replace default passwords, secure remote access with phishing-resistant MFA, segment IT and OT, and keep the ability to operate manually with tested backups. Build the baseline around them by layer.

Enterprise and plant boundary

Industrial DMZ: all traffic between corporate IT and the plant terminates in a DMZ (Level 3.5) with no direct routes; historian replication, patch distribution and remote access brokers live there. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Separate OT identity: a plant or OT Active Directory with no trust to corporate, or local accounts managed centrally; corporate credentials do not log on to HMIs or engineering workstations.
Kill switch: a documented, tested way to disconnect each plant from the corporate network without stopping production.

Plant operations (Level 3)

Tier 0 for the plant: MES, recipe servers and plant domain controllers hosted locally, patched on a schedule, and backed up offline and immutably. See the Backup Security and Immutable Backup Guide.
Endpoint protection suited to OT: application allowlisting on servers and HMIs that cannot take frequent signature updates, run in audit mode for a full production cycle before enforcing.
Engineering workstations: dedicated, inventoried, without email or web browsing, with project files in a controlled repository. See the Engineering Workstation Security Guide.

Cell and control (Levels 0 to 2)

Cell zoning: group lines or cells into zones with conduits that allow only the required protocols, so an infected HMI cannot reach every PLC in the plant.
Controller protection: enable controller access protection and run/program key positions where available, and compare programs to known-good versions. See the PLC Security Guide and the Siemens SIMATIC S7 and TIA Portal Hardening Guide.
Removable media: USB ports on HMIs disabled or restricted, with a scanning kiosk for media that must enter. See the Removable Media and USB Control Guide.
Robots, CNC and IIoT: isolate vendor cloud connectors and robot controllers in their own zones. See the Robotics Security Guide and Industrial IoT (IIoT) Security Guide.

Integrators, OEMs and machine builders

Third parties are inside most plants every week. Machine builders ship equipment with embedded remote access routers, integrators carry project files between customers, and OEMs push updates for drives, robots and vision systems.

Inventory every remote path: cellular routers in machine cabinets, vendor VPN clients and remote desktop tools; anything not brokered through the DMZ is removed or disabled.
Contract for security: require integrators to follow your remote access, media and password rules, to deliver project files and documentation for every change, and to report incidents. Use ISA/IEC 62443-2-4 language for service providers and 62443-4-2 component requirements in purchasing. See the OT Integrator and Service Provider Security Guide and OT Product Procurement Guide.
Factory and site acceptance tests: add security checks (default accounts removed, unused services disabled, firmware versions recorded) to FAT and SAT, when changes are cheapest.

Regulation and customer requirements

NIS2: several manufacturing activities, including machinery, motor vehicles, electrical equipment and electronics, are listed as other critical sectors, so many manufacturers in the EU are important entities with risk management and incident reporting duties. See the NIS2 Directive Guide.
Machinery Regulation (EU) 2023/1230: replaces the Machinery Directive and brings cyber risk into machine safety: recital 25 refers to risks provoked by malicious third parties that affect product safety, and Annex III sections 1.1.9 and 1.2.1 cover protection against corruption and the safety and reliability of control systems. Machine builders and manufacturers that modify machines should plan for it now.
Cyber Resilience Act: applies to products with digital elements that manufacturers place on the EU market, including industrial components. See the EU Cyber Resilience Act Guide.
Customer and defence requirements: automotive suppliers are commonly assessed against TISAX, and US defence suppliers against CMMC. See the CMMC 2.0 Level 2 Assessment Guide.
Frameworks: NISTIR 8183, the Cybersecurity Framework Manufacturing Profile, gives a voluntary risk-based roadmap for manufacturing systems; NIST SP 800-82 Rev. 3 and ISA/IEC 62443 provide the engineering detail. See the IEC 62443 Guide.

Monitoring and detection

Source	What to alert on	Why
IT to OT DMZ firewalls and brokers	New flows, direct IT to Level 2 connections, vendor sessions outside approved windows	Ransomware and access brokers cross here first
Plant domain controllers and Windows hosts	New admin accounts, mass logon failures, disabled backups or shadow copies, new scheduled tasks	Early ransomware staging behaviour
Passive OT network monitoring	New devices, PLC program downloads, mode changes, firmware updates outside change windows	Controller changes that bypass change control
Backup platform	Deleted jobs, retention changes, failed backups of MES and recipe servers	Attackers target recovery before encryption
External attack surface scans	HMIs, VNC, remote access gateways reachable from the internet	Exposed OT is found by opportunistic attackers quickly

NCCoE's manufacturing work, including behavioural anomaly detection and SP 1800-10 on information and system integrity in ICS environments, shows reference builds for this monitoring. See the OT Network Security Monitoring Guide and OT Asset Visibility Guide.

Recovery and islanded operation

Decide shutdown criteria in advance: who can order a plant to disconnect or stop, on what evidence, and how product in process is made safe.
Keep offline recovery kits per plant: MES, domain controller, recipe server and engineering workstation images, PLC programs, network device configurations and licence files. NIST SP 1339 gives quick-start considerations for OT backups.
Rehearse restore order: identity and DNS, then MES and recipe servers, then engineering systems, then IT integrations; time each step.
Run islanded: test running a line for one shift with the corporate link disconnected, using local order buffers and manual dispatch.
Coordinate with suppliers and customers: agree how you will tell them, and how you will verify their connections are clean before reconnecting.

See the OT Ransomware Response Playbook and OT Incident Response Guide.

Implementing the programme

Quarter 1, see and stop the obvious: dependency workshops at the top revenue plants, external exposure scan, removal of internet-facing OT, MFA on every remote access path, offline backups of MES and recipe servers.
Quarters 2 and 3, separate: build the industrial DMZ and the OT identity domain at a pilot plant; move traffic in stages with the old path kept available as rollback for one production cycle; test the plant kill switch.
Quarters 3 and 4, harden and watch: allowlisting in audit then enforce mode, cell zoning, removable media controls, passive monitoring at the pilot plant, then roll the pattern to other plants by risk.
Year 2, third parties and assurance: broker all vendor access, add security clauses to integrator and machine purchase contracts, add FAT and SAT checks, and assess plants against ISA/IEC 62443-2-1 or the NISTIR 8183 profile.

Small manufacturers should start with the five CISA mitigations, a separate OT network and offline backups; NCCoE's Security Segmentation in a Small Manufacturing Environment project shows a realistic design. Large groups need a central OT security team that sets one reference architecture and a plant security lead at every site who owns local exceptions.

Framework mapping

Programme area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISA/IEC 62443
Dependency mapping and inventory	ID.AM, GV.OC	CM-8	62443-2-1 asset owner programme
Segmentation and DMZ	PR.IR	SC-7	62443-3-2 zones and conduits, 62443-3-3
Identity and remote access	PR.AA	IA-2, AC-17, AC-6	62443-3-3 FR1 and FR2
Hardening and change control	PR.PS	CM-2, CM-3, CM-7, MP-7	62443-2-4, 62443-4-2
Third parties	GV.SC	SR-3, SA-9	62443-2-4 service providers
Monitoring	DE.CM, DE.AE	SI-4	62443-3-3 FR6
Recovery	RC.RP, RS.MA	CP-2, CP-9, CP-10	62443-3-3 FR7

Detection and measurement: programme metrics

Islanding readiness: percentage of plants that have run at least one shift disconnected from corporate IT in the last 12 months.
Recovery time: measured time to restore MES and recipe servers from offline backup in the last test, per plant.
Remote path control: percentage of vendor and remote access paths that are brokered, MFA-protected and recorded.
Internet exposure: count of OT services reachable from the internet (target zero), checked monthly.
Segmentation coverage: percentage of production lines behind an industrial DMZ with cell zoning in place.
Controller change control: PLC downloads detected outside approved change windows, and time to explain each.

Common failure patterns

Flat plant networks: office PCs, HMIs and PLCs on one subnet, so ransomware reaches the HMIs and the plant has to stop.
Corporate AD in the plant: HMIs and MES joined to the corporate domain, so a corporate compromise becomes a production compromise.
Backups that share fate: MES backups on the same domain and storage as production, encrypted with everything else.
Unknown vendor routers: cellular remote access devices in machine cabinets that no one has inventoried.
Precautionary shutdown with no restart plan: plants stopped quickly but take weeks to restart because the order of restoration was never planned, the core lesson of the Jaguar Land Rover cyberattack.
Security programme without plant engineers: controls designed centrally and rejected by plants because they ignore validation and maintenance windows.

Practitioner checklist

Run dependency workshops per plant and rank MES, recipe and identity services as plant Tier 0.
Remove every internet-exposed OT service and enforce phishing-resistant MFA on all remote access.
Build an industrial DMZ and a separate OT identity domain with no trust to corporate.
Keep offline, immutable recovery kits per plant and time a full restore at least annually.
Test running a line islanded from corporate IT for at least one shift.
Zone production cells and restrict conduits to required protocols.
Inventory and broker every vendor and machine builder remote path; add security clauses and FAT/SAT checks.
Control removable media and transient devices on the plant floor.
Monitor the DMZ, plant domain, backups and PLC changes, with alerts reaching someone who knows the plant.
Track the six programme metrics per plant and report them with production KPIs.

Manufacturing Cybersecurity Programme Guide: Protecting production from ransomware to the plant floor