Food and Beverage Manufacturing Cybersecurity Guide

Food and beverage plants run on perishable timelines, so a ransomware outage of a few days can mean destroyed product, empty shelves and food safety records that cannot be produced when a regulator asks for them. The sector is large and mostly private: CISA counts more than 200,000 registered food manufacturing, processing and storage facilities in the United States alone, and the industry accounts for roughly one fifth of national economic activity. Plants combine IT systems (ERP, warehouse management, traceability) with OT (PLCs, batch control, refrigeration, CIP cleaning, packaging lines) and are often run with small IT teams. This guide covers the sector's threats, how cyber risk interacts with FDA food safety and food defence rules, the controls that differ from general manufacturing, and how to plan for ransomware recovery. It is for plant managers, food safety and quality leads, OT engineers and IT security teams at processors, dairies, meat packers, bakeries and beverage makers. For farms and primary production see the Cybersecurity for Agriculture Guide.

Key takeaways

Ransomware is the main threat. The JBS USA attack in 2021, which JBS says ended with a ransom payment equivalent to $11 million, showed how quickly an IT compromise stops meat processing.
Food safety depends on data. FSMA rules require written plans and records, including traceability records FDA can request within 24 hours, so availability and integrity of those systems is a compliance issue.
OT carries food safety risk. Altered pasteurisation, cooking, chilling or CIP parameters are a food safety hazard, not just downtime, so integrate cyber scenarios into HACCP and food defence thinking.
Segment IT from OT and keep plants running independently. A plant that can run a shift without ERP and the corporate network loses less when ransomware strikes.
Backups and manual fallbacks decide recovery time. JBS credited "redundant systems and encrypted backup servers" for its recovery; test both before you need them.

Threats specific to food and beverage

Threat	How it plays out in a plant	Impact
Ransomware on IT	ERP, order management, label printing and shipping systems encrypted	Lines stop because orders, recipes or labels are unavailable, even if OT is untouched
Ransomware reaching OT	HMIs, batch servers and historians on Windows encrypted through shared domains or flat networks	Loss of control and visibility of process steps
Process manipulation	Setpoints for temperature, time or dosing changed through remote access or engineering workstations	Under-processed or contaminated product, recalls
Refrigeration and cold chain disruption	Building management or refrigeration controllers disabled	Spoiled inventory within hours
Theft of recipes and formulations	Intellectual property taken from R&D or PLM systems	Competitive and contractual loss
Supplier and logistics compromise	Business email compromise on payments, compromised logistics or packaging providers	Fraud, delivery disruption
Exposed remote access	Vendor modems, remote desktop tools or internet-facing HMIs left from equipment installation	Direct path into OT

The JBS USA case is the reference incident. In its 9 June 2021 statement JBS USA confirmed it had paid the equivalent of $11 million in ransom after a "criminal hack against its operations", said most of its facilities were running when it paid, and said preliminary findings showed no company, customer or employee data was compromised. For ransomware playbooks see the OT Ransomware Response Playbook.

Regulation and how cyber risk fits

US food regulation does not, today, contain a dedicated cybersecurity rule for food manufacturers. Cyber risk matters because several existing obligations depend on systems being available and trustworthy. Confirm the current status of each rule with FDA before relying on dates.

Rule or regime	What it requires	Why cyber matters
FSMA Mitigation Strategies to Protect Food Against Intentional Adulteration (final rule published May 2016)	A written food defence plan with a vulnerability assessment of actionable process steps, mitigation strategies, monitoring, corrective actions, verification, training and records. FDA estimated about 3,400 covered firms operating 9,800 facilities; farms are not covered	FDA's summary page does not mention cyber, but a deliberate change to a process step through a control system can have the same effect as physical tampering. Consider including control system access in the vulnerability assessment of actionable process steps
FSMA Food Traceability Rule (21 CFR Part 1, Subpart S)	Records of Key Data Elements for Critical Tracking Events, a written traceability plan and records available to FDA within 24 hours of a request, including an electronic sortable spreadsheet when needed in an outbreak or recall	Traceability systems must survive ransomware. FDA states the original compliance date of 20 January 2026 is being moved to 20 July 2028, following a Congressional direction not to enforce before that date
Critical infrastructure designation	Food and Agriculture is a US critical infrastructure sector; USDA and HHS are co-Sector Risk Management Agencies	Access to sector information sharing and CISA services
EU NIS2 (Directive (EU) 2022/2555)	Includes production, processing and distribution of food among its "other critical sectors" for larger entities	Risk management and incident reporting obligations for in-scope EU companies; confirm national transposition

For NIS2 obligations see the NIS2 Directive Guide.

Controls that differ from the general case

Protect food safety critical control points

Identify cyber-relevant CCPs: list each critical control point or preventive control implemented by a controller (pasteuriser, retort, oven, chiller, metal detector, CIP). Record which systems can change its setpoints.
Engineer limits in the controller: hard limits in PLC logic so a setpoint outside the validated range is rejected, and an alarm if it is attempted. See the PLC Security Guide.
Independent verification: keep independent recorders or manual checks at critical control points, so a manipulated reading would be caught by the food safety process. The ATT&CK for ICS Impair Process Control Tactic Guide explains the techniques involved.
Change control: every recipe or setpoint change goes through the same approval as a food safety change, with the engineering workstation session logged.

Segment and simplify plant networks

Separate IT and OT: a distinct OT network and identity domain per plant, with a DMZ for historians and MES integration. The #StopRansomware Guide recommends separating IT and OT and segmenting networks to contain intrusions. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Plant autonomy: design so a plant can keep producing for a defined period if ERP and corporate links are cut, with recipes, schedules and label templates cached locally.
Clean up vendor access: food equipment often arrives with vendor remote access. Inventory it, remove permanent connections and broker access through a controlled path. See the OT Remote Access Guide.

Plan for ransomware recovery

Offline and tested backups: the #StopRansomware Guide (CISA, MS-ISAC, NSA and FBI, September 2023) recommends offline, encrypted backups that are tested regularly, and golden images for critical systems. Include PLC programs, HMI projects, recipes and traceability databases.
Manual operations: paper batch records, manual label printing and manual shipping documentation, rehearsed with production staff.
Product decisions: agree in advance with food safety and quality who decides whether product made during an incident can be released, and what evidence they need.

How priorities differ across sub-sectors

The same controls apply across the sector, but the process that matters most, and therefore where to start, differs.

Sub-sector	Systems to protect first	Why
Meat and poultry processing	Production scheduling, carcass tracking, chilling and refrigeration controls	Live animal intake cannot pause for long, and chilled product spoils quickly
Dairy	Pasteurisation controls and recording, CIP systems, silo and tank management	Pasteurisation is a critical control point; raw milk must be processed within tight windows
Beverages and brewing	Batch and recipe management, filling lines, blending and dosing controls	Recipes are core intellectual property and dosing errors affect safety and quality
Bakery and confectionery	Oven and mixer controls, allergen management and label printing	Wrong labels with undeclared allergens are a common cause of recalls
Frozen and cold storage	Refrigeration plant controls, warehouse management, temperature monitoring	A failed refrigeration plant can destroy the whole inventory

Label and allergen systems deserve special mention across all sub-sectors. They usually sit on the IT side, depend on ERP master data and print at the line. If ransomware stops them, lines stop; if an attacker alters master data, the plant may print incorrect allergen information. Protect the master data with the same change control as recipes, and keep a validated manual fallback.

Working with customers, co-packers and suppliers

Brand owners and retailers: large customers increasingly include security questions in supplier audits. Keep a short evidence pack: segmentation diagram, MFA coverage, backup test results and incident contacts.
Co-packers: when production is outsourced, agree how recipes and specifications are shared, who can access them and how quickly the co-packer must notify you of an incident.
Equipment and integrator suppliers: specify security requirements in purchase orders for new lines, including no permanent remote access, documented accounts and backup of control programs at handover. See the OT Third-Party and Integrator Access Guide.
Logistics and cold chain providers: confirm how temperature records and shipment data will be available if their systems or yours are down.

Where identity fits

Ransomware in manufacturing usually moves through stolen or shared credentials: a VPN account without MFA, a domain admin used across IT and OT, or a vendor password that never changes.

MFA on all remote access: the #StopRansomware Guide recommends phishing-resistant MFA, prioritising email, VPN and accounts that reach critical systems. The Colonial Pipeline Ransomware Attack 2021 shows how one unused VPN account can stop operations at an industrial company: the account was still active, its password had leaked and it had no MFA, and the company shut down its pipeline system from 7 to 13 May 2021 as a precaution. Review dormant remote access accounts every quarter and disable any without a current owner.
Separate OT accounts: no corporate domain admin accounts in the plant domain; named accounts for operators and engineers where systems allow, and documented exceptions where shared HMI logins remain.
Service accounts: MES, historian and integration service accounts with limited rights, owners and rotated passwords. See the Manufacturing Identity and OT Access Guide.
Supplier and EDI credentials: API keys and accounts used for retailer portals, EDI and logistics platforms need owners and rotation.

Implementation roadmap

Map critical processes: with food safety, list critical control points, the systems that control or record them, and the business systems each line needs to run. See the OT Asset Visibility Guide.
Close the front doors: MFA on VPN, email and remote access; remove internet-exposed HMIs and unmanaged vendor modems.
Back up OT: collect PLC programs, HMI projects and recipes, store copies offline and test a restore on a spare controller or simulator.
Segment one plant first: design the IT/OT boundary on a pilot site, run it in monitoring mode to find dependencies, then enforce. Keep the previous firewall rules ready to restore if a line stops.
Write the plant-down playbook: manual operation, product hold and release decisions, customer and regulator communication, and FDA traceability record production from backups.
Exercise: run a ransomware tabletop with plant, food safety, IT and leadership at least yearly.
Extend: roll the pattern to other plants and add OT network monitoring. See the Manufacturing Cybersecurity Programme Guide.

Decision guidance: a single-site processor with one or two IT staff should start with MFA, offline backups, removal of exposed remote access and a manual operations plan; these give most of the risk reduction. Multi-site groups should standardise a plant reference architecture and central monitoring. Co-packers and contract manufacturers should expect brand owners to ask about these controls and should be ready with evidence.

Detection and measurement

Monitor: remote access logins to OT, new admin accounts, mass file changes on plant servers, setpoint and recipe changes outside approved windows, and controllers placed in program mode.
Log at the boundary: IT/OT firewall logs and DMZ server logs into the SIEM, with alerts on new flows.

Metrics:

Percentage of remote access paths into plants with MFA (target 100%).
Percentage of PLCs and HMIs with a tested offline backup in the last quarter.
Hours a plant can operate without ERP and corporate network access, as tested.
Number of setpoint or recipe changes without an approved change record.
Time to produce FDA traceability records from backup systems in an exercise (target within 24 hours).

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Asset and process mapping	ID.AM-08	CM-8 System Component Inventory
MFA and account separation	PR.AA-03	IA-2 Identification and Authentication (Organizational Users)
IT/OT segmentation	PR.IR-01	SC-7 Boundary Protection
Setpoint and recipe change control	PR.PS-01	CM-3 Configuration Change Control
Offline backups and recovery	RC.RP-01	CP-9 System Backup, CP-10 System Recovery and Reconstitution
Monitoring	DE.CM-01	SI-4 System Monitoring

For OT-specific control tailoring see the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide.

Common failure patterns

Plants that cannot run without head office: recipes, schedules and labels only in central ERP, so an IT incident stops every line.
Flat plant networks: office PCs, HMIs and batch servers on the same network and domain, so ransomware spreads to OT.
Vendor remote access left behind: remote tools installed during commissioning and never removed.
Backups that miss OT: IT servers backed up, but PLC programs and HMI projects exist only on a laptop or the devices themselves.
Cyber outside food safety: HACCP and food defence plans that ignore the systems controlling critical steps.
VPN accounts without MFA: the pattern behind several industrial ransomware cases, including Colonial Pipeline.

Practitioner checklist

Critical control points and the systems that control or record them are documented.
Controllers enforce validated limits for critical setpoints.
All remote access into plants uses MFA and brokered vendor sessions.
Each plant has a separate OT network and identity domain with a DMZ.
PLC programs, HMI projects, recipes and traceability data have tested offline backups.
A plant-down playbook covers manual operations and product release decisions.
Traceability records can be produced within 24 hours from backup systems.
Ransomware tabletop exercises include food safety, plant and leadership.
Label, allergen and recipe master data changes follow the same approval as food safety changes, with a validated manual fallback.
Dormant VPN and vendor accounts are reviewed quarterly and disabled when they have no current owner.

Food and Beverage Manufacturing Cybersecurity Guide: Protect Plants, Recipes and Food Safety Records