Cybersecurity for Manufacturing, From the Shop Floor to Accounts Payable
Cybersecurity for manufacturing has to protect production as well as data. In the FBI's 2025 IC3 report, Critical Manufacturing was one of the three critical infrastructure sectors most affected by the leading ransomware variants. For a small plant the damage is counted in lost shifts and late shipments, so we start with the paths an attacker would take from an office inbox to a machine, and close them in order.
The short answer
Cybersecurity for manufacturing protects the office systems that take orders and pay suppliers, and the shop-floor equipment that makes the parts. NetSys separates the plant network from the office, puts vendor remote access behind named sessions that expire, monitors endpoints, and keeps immutable, tested backups of ERP data. Defense suppliers get NIST SP 800-171 and CMMC self-assessment support.
Closest related page: Managed IT services for manufacturing. The industry page covers everyday IT support for plants; this page is the security program: segmentation, vendor access, ransomware recovery and defense-contract requirements.
Small and mid-sized manufacturers: machine shops, fabricators, food and packaging plants, and contract manufacturers, often with one person who handles IT on top of another job. Their floors mix new equipment with controllers the machine vendor will not let anyone update, and builders and integrators dial in for support. When a customer, insurer or defense prime asks how all of it is protected, someone has to answer.
An attacker does not need to touch a machine to stop production. A phishing email or an exposed remote-access login is enough if the office and the floor share one network, because the ERP server and the machines' file shares are then one step away. The FBI's ransomware recommendations in its 2025 IC3 report apply to plants as much as offices: segment networks, require MFA, keep offline or immutable backups, and patch internet-facing systems first.
Close the paths from the inbox to the machine
We start with a plant walk-through and a map of every connection: office PCs, engineering workstations, machine controllers, HMIs, scanners, cameras and each vendor with a way in. Then we separate the plant network from the office, with firewall rules written for the traffic that must cross, such as programs going out to a machine and production counts coming back. Vendor access moves to named, MFA-protected sessions that expire. Controllers that cannot be patched stay in service, isolated and watched. ERP data and drawings get immutable backups and a timed restore, and the restore order is agreed with the plant manager in advance.
What Cybersecurity for Manufacturing Includes
Plant and Office Separation
An infected office laptop should not be able to reach a machine.
- Separate zones for machines and HMIs, engineering, office and guest traffic
- Firewall rules for the traffic that must cross, and nothing else
- No direct internet exposure for controllers, HMIs or plant servers
- Default passwords changed on plant devices and network gear
Vendor and Remote Access
Machine builders need a way in; it should be yours to open.
- Named accounts with MFA instead of a shared vendor login
- Sessions approved per visit, logged and set to expire
- Standing VPNs and unmanaged remote-control tools found and removed
- A written list of which vendor can reach which machine
Ransomware Recovery for Production
Planned before an incident, practiced on a weekend.
- Immutable backups of ERP databases, CAM programs, drawings and quality records
- Timed restore tests, with the results recorded
- A restore order agreed with the plant manager
- Paper fallbacks documented so the floor can keep running while systems come back
Office Threats and Customer Requirements
Where money and drawings leave the building.
- Managed endpoint detection on office and engineering computers
- Callback checks before anyone changes a supplier's bank details
- Filtering for lookalike supplier domains
- NIST SP 800-171 controls and an SPRS score for defense work
- Evidence for customer and insurer security questionnaires
Why manufacturers use NetSys for security
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your manufacturing cybersecurity stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
- We isolate equipment you cannot replace instead of telling you to replace it
- Plant changes happen in production windows you approve, with the machine vendor involved
- More than 30 ransomware incidents handled in three years, every one fully recovered
- Plain answers on CMMC: Phase II suspended since July 13, 2026, Phase I self-assessments still in force
- On-site in our named regions, including New Jersey, Connecticut and Pennsylvania; remote-first elsewhere, with site visits planned in the scope
- Month-to-month terms, the same as every NetSys client
Manufacturing Cybersecurity in practice
- Manufacturing
Large manufacturing plant in Virginia
Password management for 125 employees, management of 160 computers, and managed EDR antivirus across production and office devices.
- Manufacturing
Precision machining company recovering from ransomware
Recovery and restoration of 3 servers and 45 workstations, followed by EDR deployment and immutable backup implementation.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
What the program covers, and what it does not
Plant work is scoped in writing, because the boundary between IT and the machine vendors matters.
| Area | Included | Not included |
|---|---|---|
| Network | Zoning design, firewall rules and remote-access controls | Rewiring machines or replacing controllers |
| Plant equipment | Isolation and monitoring of controllers and HMIs | PLC programming or machine warranty work |
| Office and ERP | Endpoint detection, email filtering, ERP server backups and restore tests | ERP application configuration, which stays with your ERP vendor |
| Recovery | Immutable backups, timed restore tests and an agreed restore order | Promised recovery times before a test has measured them |
| Defense work | CUI scoping, a NIST SP 800-171 Rev. 2 gap assessment, the System Security Plan and support for Level 1 or Level 2 self-assessments in SPRS | Any CMMC certification; NetSys is not a C3PAO and certifies no one |
Plant-side changes happen only in windows agreed with the production manager and, where their equipment is affected, the machine vendor. CMMC Phase II has been suspended since July 13, 2026; Phase I self-assessments and DFARS 252.204-7012 still apply. This is general information, not legal advice.
How we start with a plant
Quick fixes come first; the segmentation project follows a design you approve.
- Kickoff with the owner and plant manager: products, shifts, customer security terms and any defense work
- Plant walk-through and a connection map, including every vendor remote-access path
- Quick fixes: shared and default passwords, exposed remote access, MFA on email
- Segmentation design agreed with the plant, then built zone by zone in scheduled windows
- Backups brought under management and a timed ERP restore test
- For defense suppliers: CUI scoping and a NIST SP 800-171 gap assessment
How pricing works for manufacturers
Ongoing security runs inside the NetSys managed agreement, priced per user per month. We do not publish prices. What moves the price:
- Office users and devices, plus the plant devices we monitor
- Number of sites, and how much on-site time each needs
- Segmentation and firewall work, quoted as a project
- Whether you hold CUI and need NIST SP 800-171 work
Projects are scoped in writing with their own milestones.
Manufacturing Cybersecurity FAQs
What are the biggest cyber threats to manufacturers?
Ransomware is the threat that stops production: the FBI's 2025 IC3 report names Critical Manufacturing among the sectors most affected by the leading ransomware variants. Two others do steady damage: invoice and payment fraud through spoofed supplier email, and vendor remote access into plant equipment that nobody manages or logs.
Does CMMC apply to my manufacturing business?
CMMC applies if you handle federal contract information or controlled unclassified information under a defense contract or subcontract. On July 13, 2026 the Department of War suspended Phase II, so no third-party certification is currently required; Phase I self-assessments at Level 1 or 2 and your DFARS 252.204-7012 duties still apply. This is general information, not legal advice.
How do you secure OT and shop-floor systems?
We follow the five mitigations CISA and its partners published for operational technology: take OT off the public internet, change default passwords, secure remote access, segment IT from OT, and keep the ability to run equipment manually. We add monitoring on the paths in and out, and isolate controllers that cannot be patched.
Can you protect machines that run old, unsupported Windows?
Yes, by isolating them rather than patching them. The controller sits in its own zone, only the file transfers it needs are allowed, it has no email or web access, and traffic in and out is monitored. That keeps an old PC from becoming the way in, without replacing a machine that still does its job.
Will security work interrupt production?
It should not. Office systems change on a normal schedule, while plant changes happen only in windows the production manager approves, with the machine vendor on hand where their equipment is affected. We build segmentation one zone at a time and write a rollback plan before each change goes in.
What does NIST SP 800-171 have to do with CMMC?
Level 2 of CMMC is built on the 110 requirements of NIST SP 800-171 Revision 2, checked by a self-assessment every three years with an annual affirmation while Phase II is suspended. Level 1 is an annual self-assessment and affirmation against the 15 requirements in FAR 52.204-21. The Department of War also runs select government-led assessments of 800-171.
Do we need cybersecurity if we don't do defense work?
Yes. Ransomware and payment fraud do not check for a defense contract first. Larger customers can also write security terms into supplier agreements, and cyber insurers ask about MFA, backups and endpoint protection before they renew. The controls on this page answer both, whether or not CMMC ever applies to you.
Sources and technical references
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology (May 2025)
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
- DoD CIO (Department of War): CMMC program status, including the July 13, 2026 suspension of Phase II
- DoD CIO: About CMMC, levels and assessment requirements
- NIST SP 800-171 Rev. 2: Protecting Controlled Unclassified Information
- FBI IC3 2025 Annual Report: ransomware and critical infrastructure sectors
Guides on this topic
- CMMC 2.0 and the Phase II suspension
- CMMC compliance for defense suppliers
- Cybersecurity playbook for small manufacturers
- Firewall and network segmentation
- Network segmentation for small business
- Ransomware protection and recovery
- IT for government contractors
- Privileged access management for admin accounts
Related services
Keep an office infection from reaching the floor.
Tell us your sites, shifts, ERP, the machines vendors connect to, and whether you handle defense drawings. We will propose a plant walk-through and a first scope.