Sectors · Manufacturing
Manufacturing
Converging IT and operational technology, ransomware that halts production lines, and new obligations on connected products make manufacturing uniquely exposed.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
The pressure
When a breach stops the line.
Manufacturing is where a security incident has a physical cost. Ransomware that reaches the plant network stops production, and recovery is measured in shifts rather than hours. Operational technology designed for a twenty-year life now sits alongside corporate IT, cloud production systems and supplier connections, and the join between them is where attacks land.
There is a product dimension too. If you place products with digital elements on the EU market, the EU Cyber Resilience Act applies: the obligation to report actively exploited vulnerabilities and severe incidents has applied since 11 September 2026, and the main requirements follow on 11 December 2027. Manufacturing also appears in NIS2 Annex II, covering categories such as medical devices, computer, electronic and optical products, machinery and motor vehicles, so companies with EU operations may be in scope there as well.
Challenges we hear
The pressures specific to manufacturing.
- Ransomware that stops production, where recovery is counted in shifts
- Segmenting plant and OT networks from corporate IT without stopping the line
- Legacy controllers, HMIs and machine tools that cannot be patched or replaced
- Remote access used by original equipment manufacturers, integrators and service engineers
- Customer security requirements arriving through procurement, often with Cyber Essentials attached
- Cyber Resilience Act duties on products with digital elements sold into the EU
- Design and process IP leaving with a supplier, a laptop or a departing employee
Rules that apply
The obligations and standards in play.
- IEC 62443 for industrial automation and control systems: zones, conduits and security levels
- The EU Cyber Resilience Act, where you place products with digital elements on the EU market: reporting obligations since 11 September 2026, main obligations from 11 December 2027
- NIS2 Annex II, where you have EU operations in a covered manufacturing category
- ISO 27001 for the management system, and Cyber Essentials for the procurement ask
- UK GDPR for workforce and customer data
Related
Where to start
Four steps before the CRA main obligations apply.
- Map which of your products with digital elements reach the EU market
- Separate plant and OT networks from corporate IT, starting with the routes ransomware uses
- Govern and log remote access for OEMs, integrators and service engineers
- Test recovery against a real production scenario, counted in shifts
How we help
Protection and proof, joined up.
- Network segmentation and access control between IT, OT and the plant floor
- Ransomware-resilient backup and recovery, tested against a real production scenario
- Remote-access governance for OEMs, integrators and maintenance contractors
- Supply-chain and third-party risk management, and help answering customer security audits
- Cyber Resilience Act and NIS2 scoping, so you know which obligations genuinely reach you
FAQ
Questions buyers actually ask
What should a UK manufacturer exporting connected products do now?
List the products with digital elements you place on the EU market, check which fall into the Cyber Resilience Act’s higher-risk categories, make sure someone can report an actively exploited vulnerability within 24 hours today, and start producing a software bill of materials for each product ahead of December 2027.Who needs to be able to file a Cyber Resilience Act report at a weekend?
Whoever can confirm that a vulnerability in your product is being actively exploited, plus someone authorised to submit through ENISA’s Single Reporting Platform. The 24-hour early warning runs every day of the week, so name the people, give them access and rehearse it.How do we stop ransomware reaching the plant?
Separate plant networks from corporate IT so an infection on the office side cannot reach controllers, control remote access tightly, keep offline or immutable backups of controller configurations and engineering workstations, and rehearse restoring a line, not just a server.What do customers ask manufacturers to prove about security?
Commonly Cyber Essentials or Cyber Essentials Plus as a baseline, sometimes ISO 27001, plus questions on how you protect their designs and data, control supplier access, and notify them of incidents.Where should we start with IEC 62443?
With the site rather than the standard: inventory your control systems, group them into zones by function and risk, and define the conduits between them. That zone-and-conduit model then guides segmentation, remote access and the security level each zone needs.
Worried a breach could stop production?
Let’s build the resilience to keep the line running, and the evidence to prove it.
Book a call