Manufacturing Cybersecurity: A Practical Guide for U.S. Ma

The single most important thing your manufacturing operation can do right now is close the gap between your IT network and your operational technology (OT) environment before an attacker does it for you. That means removing internet-facing PLCs, segmenting production networks from corporate systems, and having an incident plan that accounts for the factory floor, not just the server room.

Three actions to take in the next 30, 90 days:

Inventory every connected device on both IT and OT networks, including PLCs, HMIs, engineering workstations, and remote access points. You cannot protect what you cannot see.
Segment your networks. At minimum, place a firewall between your corporate IT and production OT zones. Remove any OT device with a direct public internet connection.
Enable MFA and audit remote access. Every VPN, RDP session, and vendor connection is a potential entry point. Require multifactor authentication and log all remote sessions.

Pro Tip: If your team is small, start at the single point where a successful attack would stop production entirely, whether that's a PLC controlling a critical press, a SCADA server, or a single-source supplier connection. Protect that node first, then expand outward.

Key Takeaways

Manufacturing cybersecurity requires closing the IT/OT gap first, removing internet-exposed OT assets, and building an incident plan that accounts for production constraints before any other security investment.

Point	Details
Remove internet-exposed OT assets	Internet-facing PLCs are the most exploited entry point; disconnect them and use secure gateways instead.
Segment IT from OT networks	A firewall at the IT/OT boundary stops lateral movement and is the highest-impact structural control.
Require MFA for all remote access	Every unmanaged remote session is a potential initial access vector; MFA and jump hosts close this gap.
Use NIST/CISA guidance as your framework	The CSF 2.0 Manufacturing Profile and SP 1800 series provide tested, free blueprints for your program.
Collett Systems LLC for managed manufacturing security	Fixed-price, 24/7 managed IT and security services built for small and medium manufacturers in Wisconsin.

What manufacturing cybersecurity actually covers (and why it's different from standard IT)
The threat landscape: who attacks manufacturers and what they want
Common attack vectors and vulnerabilities in manufacturing environments
Security controls that materially reduce manufacturing risk
Authoritative U.S. standards and guidance to follow
A practical roadmap for small and medium manufacturers
Responding to a cyber incident on the factory floor
How to measure program success and maintain cybersecurity maturity
How a managed IT partner can help manufacturers
Securing third-party and vendor access to OT components
Integrating IT and OT security teams without breaking production
Cybersecurity insurance for manufacturers: what to know before you buy
What actually separates manufacturers who survive an attack from those who don't
Collett Systems LLC: manufacturing cybersecurity without the guesswork
Sources

What manufacturing cybersecurity actually covers (and why it's different from standard IT)

Manufacturing cybersecurity spans three distinct layers: traditional IT systems (ERP, email, file servers), operational technology (PLCs, DCS, SCADA, HMIs), and the supply chain and safety systems that connect them. The NIST Manufacturers Guide to Cybersecurity groups recommended mitigations into Identify, Protect, Detect, Respond, and Recover, which maps directly to the factory environment where uptime, safety, and product integrity are the primary stakes, not just data confidentiality.

Technician inspecting industrial control panel

The core problem is IT/OT convergence. As manufacturers connect production equipment to enterprise networks for telemetry, remote monitoring, and supply chain integration, the attack surface grows. A brownfield plant running Windows XP on a CNC controller was never designed to be internet-adjacent. When that machine gets networked for efficiency gains, it inherits every vulnerability that comes with connectivity, without the ability to run modern endpoint agents or receive patches.

The priorities in OT differ sharply from standard IT security. In IT, confidentiality typically ranks first. In manufacturing, availability and safety come first. A patch that requires a 4-hour reboot of a production line is not equivalent to patching a laptop. Integrity of PLC logic and HMI data is a safety issue, not just a compliance checkbox. This is why CISA's Industrial Control Systems guidance recommends secure-by-design procurement, removal of direct internet exposure for OT assets, and secure gateways as compensating controls where legacy devices cannot be replaced.

Sector-level signal: Reports indicate an 87% increase in ransomware targeting industrial organizations in a recent year, with manufacturing consistently ranking among the most-targeted sectors in the U.S.

The threat landscape: who attacks manufacturers and what they want

Manufacturers face a concentrated set of adversaries, each with different motives and methods.

Ransomware groups target production environments because downtime is immediately costly. Stopping a line for 24 hours can cost more than the ransom demand, which is exactly the leverage attackers want.
Nation-state APTs pursue long-term access to OT networks for intelligence gathering, IP theft, and pre-positioning for potential disruption. These actors are patient and methodical.
Industrial espionage actors target proprietary process data, formulations, and engineering files, often through supply chain or vendor access rather than direct intrusion.
Supply chain attackers compromise software updates, firmware, or vendor remote access tools to reach multiple manufacturers through a single trusted entry point.
Insider threats and human error account for a significant share of incidents, from misconfigured firewall rules to employees clicking phishing links that deliver initial access to ransomware operators.

A concrete example of the nation-state threat: a joint FBI/CISA advisory documented Iranian-affiliated actors exploiting internet-facing PLCs across U.S. critical infrastructure, modifying PLC project files and HMI/SCADA data. The advisory specifically called out traffic on ports 44818, 2222, 102, and 502 as indicators to monitor. The attack vector was simple: PLCs with no authentication exposed directly to the internet.

Manufacturers are high-value targets for three compounding reasons. First, production disruption creates immediate financial pressure. Second, manufacturing IP (process recipes, tooling designs, customer specifications) has direct commercial value. Third, many OT environments have poor visibility, meaning attackers can dwell for months before detection.

Common attack vectors and vulnerabilities in manufacturing environments

Most successful attacks against manufacturers exploit a short list of well-documented weaknesses.

Internet-facing PLCs and HMIs with no authentication or weak default credentials, directly reachable from the public internet.
Insecure remote access via unmanaged RDP, consumer-grade VPNs, or vendor jump connections with shared credentials and no session logging.
Legacy operating systems and firmware (Windows XP, Windows 7, embedded firmware with no update path) that cannot receive patches and cannot run modern security agents.
Weak or absent authentication on engineering workstations, historian servers, and OT management interfaces.
Unmanaged IoT and IIoT devices added to production networks without security review, often with factory-default credentials.
Poor logging and visibility in OT environments where network traffic is rarely captured and anomalies go undetected for extended periods.
Third-party and vendor exposures from contractors who connect laptops directly to OT networks or use shared VPN credentials.

OT constraints make direct application of IT security controls impractical in many cases. Latency requirements on a real-time control loop mean you cannot insert a security agent that adds processing delay. Deterministic timing in PLC execution means you cannot schedule a scan during "off hours" the way you would on a server. Legacy firmware simply has no update mechanism.

Pro Tip: For OT assets you cannot patch or agent, compensating controls do real work: place a next-generation firewall or industrial security gateway in front of the device, enforce strict ACLs that allow only the specific IP addresses and ports the device legitimately needs, require all vendor access through a monitored jump host, and deploy network-based anomaly detection that watches traffic patterns without touching the endpoint.

Sensing devices and IIoT endpoints deserve specific attention. Cybersecurity for sensing devices is an often-overlooked gap: these devices frequently run minimal firmware with no authentication, yet they feed data into SCADA systems that operators trust implicitly.

Hands connecting diagnostic tool to IIoT sensor

Security controls that materially reduce manufacturing risk

The controls below are prioritized by impact-to-effort ratio for a typical small or medium manufacturer. Not every control is feasible for every OT asset, but the list reflects what NIST NCCoE's SP 1800-10 demonstrates as applicable to manufacturing ICS environments.

Asset inventory: You cannot segment, patch, or monitor what you have not cataloged. Build and maintain a complete inventory of IT and OT assets, including firmware versions and network connections.
Network segmentation and security zones: Separate IT from OT with firewalls. Within OT, create zones by criticality and function. Map real traffic flows before locking down ACLs.
Secure remote access: Replace open RDP and consumer VPNs with brokered access through a monitored jump host. Require MFA for every remote session.
Strong authentication (MFA): Apply to all IT systems and, where OT systems support it, to engineering workstations and historian access.
Application allowlisting: On engineering workstations and HMI systems, permit only known-good executables. This is one of the highest-impact controls for stopping ransomware in OT-adjacent systems.
Behavior anomaly detection (NDR/OT-aware monitoring): Passive network monitoring that detects unusual traffic patterns without touching endpoints. Practical for legacy OT environments.
File integrity and firmware checks: Detect unauthorized changes to PLC project files, HMI configurations, and firmware images.
Managed patching where feasible: Patch IT systems on a defined cadence. For OT, coordinate with vendors and schedule maintenance windows; accept compensating controls where patching is not possible.
Backups and recovery plans: Maintain offline, tested backups of PLC configurations, HMI projects, historian data, and IT systems. Test restoration regularly.

Pro Tip: With a limited budget, invest in this order: segmentation first (stops lateral movement), then secure remote access (closes the most common initial access vector), then logging and anomaly detection (gives you visibility). Everything else builds on that foundation.

Authoritative U.S. standards and guidance to follow

The U.S. government has published a substantial body of free, practical guidance for manufacturers. These are the documents worth downloading and keeping on hand.

NIST CSF 2.0 Manufacturing Profile: Maps the six CSF functions (Govern, Identify, Protect, Detect, Respond, Recover) to manufacturing-specific outcomes. Use it to structure your program and justify budget requests to leadership.
NIST SP 1800-10 (NCCoE): Lab-tested example solutions for protecting ICS integrity, including application allowlisting, behavior anomaly detection, file integrity checking, and secure remote access architectures. Directly applicable to discrete and continuous manufacturing.
NIST SP 1800-41 (NCCoE): Tested response and recovery workflows for ICS environments, with explicit attention to OT constraints like limited logging and vendor dependencies during restoration.
CISA ICS resources and advisories: CISA maintains active advisories, Cybersecurity Performance Goals (CPGs), and deployable assessment tools for ICS owners and operators. Check the CISA ICS page regularly for new advisories and free resources.
Joint FBI/CISA advisories: When a specific threat targets manufacturing OT (as with the PLC exploitation advisory), these joint advisories provide indicators of compromise, affected ports, and specific mitigations. Subscribe to CISA alerts to receive them as published.

Use these documents together: the Manufacturing Profile sets your program structure, the SP 1800 practice guides give you tested technical patterns, and CISA advisories keep you current on active threats.

A practical roadmap for small and medium manufacturers

The NIST Manufacturers Guide frames the program in five phases. Here is how to sequence them with realistic timing.

Days 1, 30 (Identify, quick wins): Complete an asset inventory of all IT and OT devices. Identify and remove any OT device with a direct public internet connection. Document your network topology. Effort: low cost, primarily staff time or a one-time assessment engagement.
Days 30, 90 (Protect, near-term): Implement network segmentation between IT and OT. Deploy a managed firewall at the IT/OT boundary. Require MFA for all remote access. Replace open RDP with a monitored jump host. Establish offline backups of PLC configurations and critical IT systems.
Days 90, 180 (Detect, mid-term): Deploy OT-aware network monitoring (NDR) to establish a baseline of normal traffic. Enable application allowlisting on engineering workstations and HMI systems where feasible. Implement firmware integrity checks for critical PLCs. Begin log collection and retention.
Days 180, 365 (Respond and Recover, long-term): Develop and test an incident response plan that includes OT-specific containment steps. Run a tabletop exercise with plant operations, IT, and leadership. Formalize vendor access policies and supply chain security requirements. Review cyber insurance coverage.
Ongoing (Govern and mature): Quarterly vulnerability scans, annual tabletop exercises, regular review of CISA advisories, and continuous improvement against the CSF Manufacturing Profile.

Staffing guidance: Small manufacturers (under 100 employees) rarely have the internal capacity to execute all five phases alone. A co-managed model, where an external partner handles monitoring, firewall management, and incident response while internal staff retain operational control, is often the most practical path. Fully managed services make sense when there is no dedicated IT staff on site.

Pro Tip: Pick one measurable KPI for each phase and report it to leadership monthly. "Number of internet-exposed OT assets" is a powerful early metric because it goes from a nonzero number to zero, and that progress is visible and defensible.

Responding to a cyber incident on the factory floor

Speed and discipline in the first hour determine whether an incident becomes a contained event or a multi-week production shutdown.

Detect and isolate: When anomalous behavior is confirmed, isolate affected systems from the network. Do not shut down PLCs or HMIs unless safety requires it; a running system preserves volatile evidence and avoids uncontrolled shutdown of physical processes.
Preserve evidence: Before making any changes, capture network logs, system logs, and memory images from affected IT systems. In OT environments, photograph HMI screens and capture PLC project files before any remediation.
Validate safety systems: Confirm that safety instrumented systems (SIS) are operating normally and have not been tampered with. This is the first OT-specific check that has no IT equivalent.
Stop further changes: Prevent any unauthorized writes to PLCs or HMIs. Lock down engineering workstation access until the scope of compromise is understood.

Internal coordination: Notify plant operations leadership, IT/OT security staff, and legal counsel immediately. Do not communicate details over potentially compromised email systems.

External coordination: Contact CISA (1-888-282-0870) and the FBI's Internet Crime Complaint Center (IC3) for significant OT incidents. Notify your cyber insurance carrier within the timeframe your policy requires. Engage OT-aware incident responders; standard IT forensics firms often lack the PLC and SCADA expertise needed to safely investigate OT environments.

Recovery: Use validated, offline backups of PLC configurations and HMI projects for restoration. NIST SP 1800-41 provides tested recovery workflows that account for vendor dependencies and the limited logging typical in OT environments. Stage your restore: bring safety systems up first, then production control, then ancillary systems.

Pro Tip: Avoid rebooting OT devices during forensic investigation. Many PLCs and embedded controllers store volatile evidence (active connections, recent writes) only in RAM. A reboot destroys that evidence before responders can capture it. Work with OT-aware responders who know how to image these systems safely.

How to measure program success and maintain cybersecurity maturity

A program without metrics is just a list of good intentions. These KPIs give you concrete evidence of progress.

Asset inventory completeness: Percentage of known devices with documented owner, firmware version, and network connection. Target: 100% within 90 days.
Internet-exposed OT assets: Count of OT devices reachable from the public internet. Target: zero.
Patch cadence (IT systems): Percentage of critical patches applied within your defined SLA (typically 30 days for critical, 90 days for high).
Mean time to detect (MTTD): How long between an event occurring and your team knowing about it. Baseline this early; improvement is the goal.
Mean time to respond (MTTR): Time from detection to containment. Track separately for IT and OT incidents.
Tabletop exercise frequency: At minimum, one OT-focused tabletop per year with plant operations and leadership present.
Vendor access audit: Quarterly review of active vendor accounts, VPN credentials, and remote access sessions.

Report these metrics to executives in business terms. "We reduced internet-exposed OT assets from 12 to zero" is more compelling than a technical vulnerability count. "Our MTTD dropped from 72 hours to 4 hours" translates directly to reduced production risk. Connecting security metrics to production uptime and insurance posture gets budget approved.

Routine activities that sustain the program: scheduled vulnerability scans on IT systems, continuous OT network monitoring, 90-day log retention with quarterly review, and annual review of vendor contracts for security requirements.

How a managed IT partner can help manufacturers

Most small and medium manufacturers do not have a dedicated OT security engineer on staff. A managed IT partner with manufacturing experience fills that gap without requiring a full-time hire.

A capable partner should deliver:

24/7 monitoring of IT systems and OT network traffic, with alerts tuned to manufacturing-specific baselines.
Managed firewall and secure remote access at the IT/OT boundary, including vendor access controls and session logging.
OT-aware logging and alerting that captures anomalies in PLC communications and engineering workstation activity without disrupting production.
Endpoint protection (EDR) for IT systems including engineering workstations and historian servers.
Backup and recovery orchestration covering both IT data and OT configurations (PLC projects, HMI files, historian archives).
Tabletop exercises and incident response support that include plant operations staff, not just IT.
Compliance documentation for cyber insurance, customer audits, and regulatory requirements.

Co-managed vs. fully managed: Co-managed services work well when a manufacturer has internal IT staff who understand the production environment but lack security depth. The partner handles monitoring, threat response, and security tooling while internal staff retain control of day-to-day operations. Fully managed makes sense when there is no dedicated IT presence on site.

Collett Systems LLC delivers manufacturing-focused managed IT services with fixed per-user pricing, 24/7 monitoring, and local accountability. Manufacturers working with Collett Systems get a documented security stack, not a tiered service menu where critical protections cost extra.

Pro Tip: When evaluating a managed IT partner for OT environments, ask specifically whether their monitoring tools are OT-aware (passive, protocol-aware NDR) or standard IT tools applied to OT. The difference matters: an IT-only tool scanning a PLC network can disrupt real-time control processes.

Securing third-party and vendor access to OT components

Vendor and supply chain risk in OT environments goes well beyond the general concern about software supply chain attacks. The specific problem in manufacturing is that OEM vendors, system integrators, and maintenance contractors routinely need direct access to PLCs, HMIs, and SCADA systems, often with elevated privileges and sometimes with their own laptops connected directly to the production network.

Start with a formal vendor access policy that requires all third-party connections to go through a monitored jump host with session recording. Shared credentials for vendor accounts are a persistent problem; require individual named accounts for each vendor technician and revoke access immediately after the work is complete. Quarterly audits of active vendor accounts regularly surface credentials that were never deactivated after a project ended.

For OT components themselves, require vendors to provide a software bill of materials (SBOM) for any firmware or software they supply. CISA's Secure by Demand guidance frames this as a procurement problem: manufacturers who require secure-by-default products with robust logging and formal vulnerability disclosure processes reduce their long-term defensive costs. A formal vulnerability disclosure policy from your OT vendors gives you a defined channel for receiving and acting on product flaws before they are exploited.

Cyber-physical security adds another dimension: vendor technicians with physical access to the plant floor can introduce threats that bypass network controls entirely. Badge access logs, escort policies for sensitive areas, and physical port locks on OT equipment are controls that complement the network-level vendor access restrictions.

Integrating IT and OT security teams without breaking production

The organizational challenge of IT/OT integration is often harder than the technical one. IT security teams think in terms of confidentiality, patch cycles, and endpoint agents. OT engineers think in terms of uptime, deterministic performance, and change control windows that happen once a quarter. Both perspectives are correct for their domain, and forcing IT practices onto OT without adaptation is a reliable way to cause production incidents.

Start with a shared asset inventory that both teams contribute to and trust. This single artifact forces a conversation about what is on the network and who owns it. From there, establish a joint change control process: any security change to OT systems (firewall rule, firmware update, new monitoring agent) goes through the same review process as a production change, with sign-off from operations.

Assign a liaison role, someone who understands both IT security concepts and OT operational constraints. This person translates between teams and prevents the "IT just pushed a patch that took down Line 3" incident that poisons cross-team collaboration for years. In smaller plants, this is often a senior engineer who gets security training rather than a dedicated hire.

Training matters on both sides. OT engineers benefit from basic security awareness (phishing recognition, credential hygiene, understanding why segmentation matters). IT security staff benefit from time on the plant floor understanding what a PLC does and why a 2-second scan can disrupt a real-time process. The Idaho National Laboratory's ICS cybersecurity training programs are a practical resource for building OT security competency in engineering staff.

Physical security practices for industrial facilities also belong in this integration conversation. Cyber and physical access controls need to align, particularly for areas housing PLCs, network switches, and historian servers.

Cybersecurity insurance for manufacturers: what to know before you buy

Cyber insurance for manufacturers has become significantly more complex as underwriters have learned how OT incidents differ from standard data breaches. A policy that covers data exfiltration may explicitly exclude operational technology disruption or physical damage resulting from a cyber event. Read the exclusions carefully.

Underwriters now routinely ask about OT-specific controls during the application process: Is OT segmented from IT? Do you have MFA on remote access? Do you maintain offline backups of PLC configurations? Manufacturers with documented controls and a written incident response plan consistently receive better coverage terms and lower premiums than those without. The security program you build using this guide is also your insurance application.

Coverage areas to evaluate for manufacturing specifically: business interruption (covering production downtime, not just IT recovery costs), contingent business interruption (covering losses from a supplier's cyber incident), equipment replacement (covering physical damage from a cyber-induced process failure), and extortion/ransomware response costs. Many standard cyber policies cap or exclude the first and last of these for OT environments.

Engage a broker with manufacturing industry experience. The policy language around "physical damage" and "operational technology" varies significantly between carriers, and a broker who primarily handles retail or professional services policies may not flag the exclusions that matter most to a plant operator.

What actually separates manufacturers who survive an attack from those who don't

Most of the manufacturers I work with in Wisconsin are not failing at cybersecurity because they lack awareness. They know ransomware is a real threat. They know their PLCs are aging. The gap is almost always the same: they have IT security tools protecting the office network and nothing meaningful protecting the production floor, and the two networks are connected.

The manufacturers who recover quickly from incidents share a few traits that have nothing to do with budget size. They have an offline backup of every PLC configuration. They have a written contact list for their OT vendors, CISA, and their insurance carrier. They have run at least one tabletop exercise where the plant manager was in the room. None of those things require a large security team or an enterprise budget.

The NIST and CISA guidance referenced throughout this article is genuinely useful, not bureaucratic box-checking. The CSF Manufacturing Profile gives you a shared vocabulary with leadership. The SP 1800 practice guides give you tested architectures you can hand to a vendor or an internal engineer. The joint advisories tell you exactly what attackers are doing right now and what ports to watch.

Start small, protect what matters most to production, and build from there. A program that covers your three most critical production control points is worth more than a comprehensive plan that never gets implemented.

Collett Systems LLC: manufacturing cybersecurity without the guesswork

Manufacturers in Southeastern Wisconsin who need a security program that actually fits their production environment have a direct option. Collett Systems LLC delivers managed IT and cybersecurity services for manufacturers with fixed per-user pricing, 24/7 monitoring, and no tiered service menus where the critical protections cost extra.

What that looks like in practice: managed firewall at your IT/OT boundary, endpoint detection and response for IT systems, OT-safe remote access patterns, backup and recovery for both IT data and PLC configurations, and local engineers who show up when something goes wrong. For manufacturers with internal IT staff, our co-managed IT model lets your team keep operational control while we handle monitoring, threat response, and security tooling.

The right first step is a paid IT and Security Assessment that maps your current IT and OT exposure, identifies your highest-priority gaps, and gives you a documented remediation plan you can act on immediately. No smoke and mirrors, no vague recommendations. Book the assessment and know exactly where you stand.

Sources

The documents below are the primary references for building and maintaining a manufacturing security program in the United States. Download and bookmark each one.

Manufacturing Cybersecurity: A Practical Guide for U.S. Manufacturers