A plant with 40 or 200 staff runs the same kinds of machines, ERP links and remote vendor support as a large manufacturer, but security usually falls to the IT generalist, the maintenance lead or an outside IT provider, with nobody who owns the shop floor network. Most guidance assumes an OT security function, an industrial DMZ and a monitoring platform. This guide is the minimum viable programme for manufacturers under about 250 staff: what to do first, what to leave until later, which free government services help, and how to meet customer and contract demands without building a team. It is for owners, operations managers, IT leads and the MSPs who support small plants. Larger organisations with a dedicated OT function should use the Manufacturing Cybersecurity Programme Guide.
Key takeaways
- Most stoppages start in IT. Email, the file server, ERP and remote access are the usual way in; protect them first, because a small plant often cannot ship without them.
- Five OT basics cover most of the risk. CISA, FBI, EPA and DOE name them: take OT off the internet, change default passwords, secure remote access, segment IT and OT, and keep the ability to run manually.
- One owner, one list, one year plan. A named person, an asset and supplier list on a spreadsheet, and a 12-month plan beat any tool bought without them.
- Free help exists. NIST MEP Centers, CISA Cyber Hygiene scanning and CSET, and in the UK NCSC guidance and Cyber Essentials support, are built for firms without specialists.
- Customers will ask. Defence, automotive and large OEM customers increasingly require evidence such as FAR 52.204-21, CMMC Level 1 or Cyber Essentials; plan for it rather than reacting to a questionnaire.
Why small plants need a different approach
A small manufacturer has the exposure of a large one with a fraction of the people. The typical pattern is:
- One flat network: office PCs, the ERP server, CNC machines, PLCs, HMIs, the label printer and the canteen Wi-Fi share one subnet behind a broadband router.
- Machine builder access: cellular routers or remote desktop tools installed by OEMs and integrators so they can support machines, often with default passwords and nobody internal aware of them.
- Old Windows on the shop floor: CAM and programming PCs that cannot be upgraded because the machine software needs an old version.
- Supply chain pressure: customers who share drawings and specifications, and who expect delivery to continue whatever happens.
- Thin recovery: machine programs and configuration live on one engineer's laptop or a USB stick.
Small suppliers also absorb the shock of incidents at their customers. The Jaguar Land Rover cyberattack halted production for more than five weeks in 2025; the UK government put the supply chain at around 120,000 jobs and arranged a £1.5 billion loan guarantee partly to support it, and the Cyber Monitoring Centre said more than 5,000 UK organisations were affected. A small plant's continuity plan should cover a major customer going dark, not only its own systems.
The threats that actually stop small plants
| Threat | How it shows up | ATT&CK v20 | Minimum control |
|---|---|---|---|
| Ransomware via IT | Phishing or a stolen remote access password leads to encrypted file server, ERP and shared drive; production stops because orders and programs are gone | T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery; ICS T0828 Loss of Productivity and Revenue | MFA, offline backups, patching of internet-facing systems |
| Exposed remote access | VPN, remote desktop or vendor portal on the internet with a reused or default password | T1133 External Remote Services, T1078 Valid Accounts | MFA on all remote access, remove unused accounts |
| Internet-reachable OT | HMI, PLC web page or VNC reachable from the internet, found by scanning services | ICS T0883 Internet Accessible Device | Remove from internet; external scanning |
| Supplier and OEM access | Machine builder support tool or cellular router used as a route into the network | T1199 Trusted Relationship, T1219 Remote Access Tools | Inventory, disable when not in use, MFA |
| Removable media | USB sticks carrying programs between the office and machines | ICS T0847 Replication Through Removable Media | Dedicated, scanned media; USB restricted on machine PCs |
| Invoice and payment fraud | Compromised email used to change supplier bank details | T1657 Financial Theft | Call-back verification of bank changes, MFA on email |
The minimum viable programme
The programme below assumes no OT specialist. It follows the five primary OT mitigations from CISA, FBI, EPA and DOE, and the small business basics set out in the NCSC Small Business Guide (email, important accounts, devices, backups and spotting attacks), which the Small Business Cybersecurity Basics Guide covers for the office side.
| Control | What "done" looks like in a small plant | Effort | Who can do it |
|---|---|---|---|
| Named owner | One person accountable, with an hour a week and a direct line to the managing director | Low | Owner or operations manager |
| Asset and supplier list | Spreadsheet of PCs, servers, machines with controllers, network devices, remote access paths and the supplier for each | Medium, once | IT lead with maintenance |
| MFA everywhere it matters | Email, VPN, remote desktop gateways, cloud ERP, banking and vendor portals | Low | IT lead or MSP |
| OT off the internet | No HMI, PLC, VNC or machine web interface reachable from outside; confirmed by an external scan | Low to medium | IT lead or MSP with the machine builder |
| Default passwords changed | Every router, switch, HMI, camera and machine interface that has a password, recorded in a password manager | Medium | Maintenance with IT |
| Supplier remote access controlled | One approved method, enabled on request, MFA, named accounts, disabled after the job | Medium | IT lead with suppliers |
| Basic segmentation | Office, production and guest Wi-Fi on separate networks with a firewall between office and production | Medium to high | MSP or integrator |
| Offline backups | ERP, file server and every machine program and configuration, with one copy offline and a restore tested | Medium | IT lead with engineers |
| Manual running and recovery plan | Written steps to run or safely stop lines, take orders and ship without ERP for a week | Medium | Operations manager |
- Password manager: store machine, router and vendor credentials in a business password manager rather than on the side of the cabinet. See the Password Manager Setup Guide.
- Machine programs: keep a copy of every PLC, CNC and HMI program and configuration on the backup, labelled by machine and version, and refresh it after every change. See the OT Backup, Recovery and Golden Image Guide.
- Old shop floor PCs: where a CAM or programming PC cannot be upgraded, take it off email and web browsing, put it on the production network only, and restrict USB. See the Engineering Workstation Security Guide and the Removable Media and USB Control Guide.
- Payment fraud: verify any change to supplier or customer bank details by phone to a number already on file.
Machine builders, integrators and IT providers
For a small plant, suppliers are the security team's extended staff and the biggest unknown. The CISA joint OT guidance specifically recommends coordinating with managed service providers, system integrators and manufacturers, because misconfigurations can come from any of them.
- Find every remote path: walk the floor with maintenance and look for cellular routers in machine cabinets, remote access software on HMIs and programming PCs, and vendor VPN clients. Add each to the supplier list with an internal owner.
- One approved route: agree a single remote access method for all suppliers, with MFA and named accounts, switched on for a job and off afterwards. See the OT Remote Access Guide.
- Purchase conditions: when buying a new machine, ask for default passwords to be changed at commissioning, unused services disabled, a list of remote access components, and a backup of programs and configuration handed over at acceptance.
- IT provider agreement: confirm in writing that the MSP uses MFA on its own tools, does not reuse passwords across clients, and will tell you about incidents affecting you. See Choosing an IT Support Provider or MSP Securely.
- Machine identities: ERP to MES or shop floor data links, label printing services and cloud connectors from machines run on service accounts and API keys. List them with an owner, remove those for retired systems, and change shared ones when a supplier relationship ends. See the Manufacturing Identity and OT Access Guide.
Free and low-cost help
| Resource | Provider | What it gives a small plant |
|---|---|---|
| MEP Center cybersecurity support | NIST Manufacturing Extension Partnership (US) | Help to assess current risk, identify gaps, implement cost-effective protections and meet legal and contractual requirements |
| Cyber Hygiene Vulnerability Scanning | CISA (US) | Free, continuous scanning of internet-facing IP addresses with weekly reports; private sector critical infrastructure organisations can enrol by emailing CISA |
| Cyber Security Evaluation Tool (CSET) | CISA (US) | Desktop application that walks owners through a step-by-step evaluation of ICS and IT networks |
| Manufacturing Profile and Low Impact examples | NIST (NIST IR 8183r1; NIST IR 8183A Volumes 1 to 3) | Profile tailored by system impact level; Volume 2 (process) and Volume 3 (discrete) include incident response and recovery plan templates in sections 3.5 and 3.6 |
| Small Business Guide | NCSC (UK) | Five areas of low-cost steps: email, important accounts, devices, backups and spotting attacks |
| Cyber Essentials support | NCSC and IASME (UK) | Free readiness tool and question set, a free 30-minute consultation with an NCSC-assured Cyber Advisor for SMEs, and cyber liability insurance for qualifying whole-organisation certifications under £20m turnover |
NIST MEP's starting guidance also points small manufacturers to CISA's tabletop exercise packages, CISA's no-cost ICS training and NIST IR 8428 on digital forensics and incident response for OT. NIST IR 8183A Volume 1 was published in September 2019 and references CSF 1.1, so map its examples to CSF 2.0 when you use them. See the NIST CSF Manufacturing Profile Guide.
Customer and contract requirements
Small manufacturers often meet security requirements first through a customer contract rather than a regulator. Decide early which of these apply.
| Requirement | Who it reaches | What it asks of a small plant |
|---|---|---|
| FAR 52.204-21 Basic Safeguarding | US federal contractors whose systems process, store or transmit federal contract information | Fifteen basic requirements, including limiting access to authorised users, authenticating users and devices, protecting boundaries, separating public-facing components, correcting flaws promptly and malware protection with periodic scans |
| CMMC Level 1 | US defence supply chain handling federal contract information | Annual self-assessment against the FAR basic safeguarding requirements. See the CMMC Level 1 Self-Assessment Guide |
| Cyber Essentials | UK public sector suppliers and many private customers | Five technical controls: firewalls, secure configuration, security update management, user access control and malware protection; Cyber Essentials Plus adds independent technical testing. See the Cyber Essentials Guide |
| Customer security questionnaires | Suppliers to automotive, aerospace and large OEMs | Evidence of MFA, backups, patching, incident contact and supplier controls; answer from the asset list and plan rather than one-off |
Scoping helps: if only a few systems handle a customer's controlled data, keeping that data on a small, well-managed set of machines is cheaper than raising the whole plant to the requirement. In the EU, check whether NIS2 or the Cyber Resilience Act applies to your sector and products using the Manufacturing Cyber Regulation Map.
Twelve-month rollout
- Month 1, own it and list it: name the owner, build the asset and supplier list, and enrol in an external scanning service or ask your MSP for an external scan.
- Months 1 to 2, lock the front doors: MFA on email, remote access, cloud ERP and banking; remove anything OT-related from the internet; change default passwords on routers and internet-facing devices first.
- Months 2 to 4, backups and recovery: set up offline backups of ERP, file server and machine programs; restore one machine program and one ERP backup to prove it works.
- Months 3 to 6, suppliers: find and control every remote path; agree the single route with each machine builder; turn off unused access. Test with one friendly supplier before applying to all.
- Months 6 to 9, separate: put production on its own network with a firewall from the office, first in monitor or permissive mode for two weeks to learn what traffic is needed, then restrict. Keep the old configuration saved and plan the change for a maintenance shutdown so it can be reversed.
- Months 9 to 12, rehearse and evidence: run a tabletop on "ransomware on Monday morning", write the manual running plan, and use the year's work to answer customer requirements such as Cyber Essentials or CMMC Level 1.
Decision guidance: buy an OT monitoring platform only after the list, MFA, backups, supplier control and segmentation are in place; for most sub-250 plants, an MSP-run firewall with logging and an external scan give more value first. If you have several sites, standardise the router and firewall model and configuration before anything else. If you are a defence supplier, scope controlled information before segmenting, because it decides where the boundary goes.
Detection and measurement
- What to watch: failed and successful remote access logins, new admin accounts, backup job failures or deletions, external scan findings, and firewall alerts on traffic from production to the internet.
- Who watches: if nobody internally can, make alert review part of the MSP agreement, with a named contact who knows which machines matter.
| Metric | Target |
|---|---|
| Remote access and email accounts with MFA | 100 percent |
| OT devices reachable from the internet (external scan) | Zero |
| Supplier remote paths inventoried and controlled | 100 percent of known paths |
| Machine programs with a current offline backup | Rising to all machines |
| Days since last successful restore test | Under 180 |
| Hours the plant could ship without ERP (tested or tabletop) | Known and rising |
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Owner and roles | GV.RR-02 | PM-2 | 17 | 5.2 |
| Asset and software list | ID.AM-01, ID.AM-02 | CM-8 | 1, 2 | 5.9 |
| MFA and accounts | PR.AA-01, PR.AA-05 | IA-2, AC-2 | 5, 6 | 5.15, 8.5 |
| Supplier remote access | GV.SC-07 | AC-17, SR-6 | 15 | 5.19, 5.20 |
| Patching and external scanning | PR.PS-02 | SI-2, RA-5 | 7 | 8.8 |
| Segmentation | DE.CM-01 | SC-7 | 12 | 8.22 |
| Removable media | PR.PS-02 | MP-7 | 10 | 7.10 |
| Backups and recovery | PR.DS-11, RC.RP-01 | CP-9, CP-10 | 11 | 8.13 |
Common failure patterns
- Buying a tool before having a list. A monitoring appliance is installed, nobody reads the alerts, and the cellular router in the press cabinet stays unknown.
- MFA on email but not on the VPN. The remote access gateway, often the first thing attackers try, keeps a password-only login for a supplier.
- Machine programs only on one laptop. When that laptop is encrypted or lost, rebuilding a CNC or PLC program takes weeks and the machine builder's time.
- Segmentation done in one weekend. A firewall is put in with tight rules, a line stops on Monday, and the rules are opened completely and never tightened.
- Backups on the same network. The backup server is joined to the same domain and encrypted along with everything else.
- No plan for the customer going down. A large customer's outage stops orders and cash flow, and there is no conversation with the bank or the customer ready.
Practitioner checklist
- Name one owner with time and authority.
- Build an asset and supplier list that includes machines with controllers and every remote path.
- Turn on MFA for email, remote access, cloud ERP, banking and vendor portals.
- Confirm by external scan that no OT device is reachable from the internet.
- Change default passwords and store them in a password manager.
- Agree one supplier remote access route, enabled per job.
- Back up ERP, files and every machine program offline, and test a restore.
- Separate office, production and guest networks, starting in monitor mode.
- Write a manual running and recovery plan and rehearse it once a year.
- Map work to customer requirements such as FAR 52.204-21, CMMC Level 1 or Cyber Essentials.
Standards and references
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- NIST MEP: Cybersecurity Resources for Manufacturers, Where to Start
- NIST: IR 8183A Vol. 1 Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide
- eCFR: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
- CISA: Cyber Hygiene Services
- CISA: Cyber Security Evaluation Tool (CSET)
- NCSC: Cyber Essentials
- NCSC: Small Business Guide
Related NHI Mgmt Group resources: Manufacturing Cybersecurity Programme Guide · Small Business Cybersecurity Basics Guide · NIST CSF Manufacturing Profile Guide · OT Security Checklist · Ransomware Prevention Guide