Customer contracts set the bar
Supply agreements often name standards, audit rights and notice periods. Read each clause, list what you promised, and know who in the plant owns the evidence for it.
Manufacturing and OT cybersecurity in the UAE: In a factory, an office breach can stop the production line.
Attackers use the common routes: an unpatched system, a stolen login, a supplier connection. In a factory, those routes end near the lines, the schedules and the customer orders that the plant earns its money from.
When the line stops, the clock that matters is yours.
Enter your own figures. Nothing here is assumed for you.
Your outage costsEnter both figures
Shift 1 8 hoursShift 2 8 hoursShift 3 8 hours
The red bar shows your stopped hours against a 24 hour day. The cost is before recovery work, penalties and lost customers.
- One weekIn the Sophos 2025 survey, 58% of manufacturers hit by ransomware fully recovered within one week, up from 44% the year before.
- Next maintenance cycleDragos found about 71% of 2025 OT vulnerabilities could wait for compensating controls or that cycle. About 3% needed immediate action.
How an exposed system becomes a stopped line
- An exposed system
A vulnerable internet-facing system, or a stolen login.
38%of manufacturing breaches began with exploited vulnerabilities (Verizon 2026 DBIR, Manufacturing snapshot) - A sensitive identity
Not only domain administrators. Engineers with access to line controllers, remote-support accounts used by equipment makers, and the help desk that can reset them.
- A plant platform
Scheduling and execution systems, engineering workstations, and the suppliers and integrators who connect to them.
61%of manufacturing breaches involved a third party (Verizon 2026 DBIR, Manufacturing snapshot) - The line stops
Ransomware on office systems can halt orders, scheduling and shipping even when the machines are untouched.
Contracts and standards set the bar
Most manufacturers are not under one cyber regulator. The bar comes from customer contracts, recognized standards, the personal data law and, for some sites, critical infrastructure designation.
Some sites may be designated
The UAE critical infrastructure policy lists chemicals and oil and gas among its critical sectors. A site is covered only if the authority designates it. If it does, mandatory requirements and audits follow.
Personal data has a duty to notify
Federal Decree-Law No. 45 of 2021 covers staff, customer and supplier data. A controller must notify when it becomes aware of a breach. Government bodies and free zones with their own data law fall outside it (Art. 2, Art. 9).
Rules and frameworks behind this page
- ISO/IECISO/IEC 27001:2022Sets the requirements for an information security management system. Customers often ask suppliers to show it.
- ISA/IECISA/IEC 62443Security requirements for industrial automation and control systems, with duties for asset owners, integrators and product suppliers.
- NIST SPNIST SP 800-82 Rev. 3Guide to securing operational technology while respecting its performance, reliability and safety needs.
- UAEUAE Federal Decree-Law No. 45 of 2021The UAE personal data protection law. It covers staff, customer and supplier data and sets a duty to notify a breach.
- UAE CIIPUAE CIIP PolicyApplies to operators the authority designates in listed critical sectors, including chemicals and oil and gas.
Source: UAE Cyber Security Council, Critical Information Infrastructure Protection Policy; UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. This is analysis, not legal advice.
UAE rules, by who you are
Which UAE rule reaches a factory, a processor or a food producer
The UAE has no general federal cyber standard for manufacturers. Duties come from designation, government ownership, customer contracts and data law. Food and product safety rules are not cyber audits.
Plants with OT/ICS or safety-related control systems
Abu DhabiRegulator ruleIndustrial licence and safety requirements, customer requirements, and UAE IA with CIIP if designated.
For designated critical entities, apply UAE IA and sector-plan controls. Manage OT assets, zones and conduits, remote vendor access, change control, vulnerability risk, monitoring and recovery according to the binding framework and plant risk.
Industrial SMEs and component suppliers
FederalContract termIndustrial licence and customer contracts. PDPL where it applies.
No blanket yearly cyber audit applies to all private factories. Customer contracts and critical supply-chain roles can require questionnaires, tests, incident reporting and recovery evidence.
Dubai government and semi-government entities that run ICS/OT
DubaiStandard or policyDESC ICS Standard, DESC ISR where the entity is a government entity, CIIP and CII if identified.
Apply the ICS standard to your critical infrastructure or ICS/OT. Confirm control applicability and keep assurance evidence.
Private factories and industrial facilities
DubaiRegulator ruleIndustrial licensing. UAE IA and CIIP only if designated. Customer and contract requirements.
Do not apply DESC ICS to private plants outside its stated scope. Confirm any designation. Secure OT and production systems as risk requires.
Food importers, manufacturers, processors and distributors
FederalBinding lawFederal Law No. 10 of 2015 on Food Safety and its executive regulation, with the Abu Dhabi and Dubai food-safety rules. UAE IA and CIIP if designated.
The law covers food safety and traceability. It sets no yearly cyber audit. Protect digital traceability, warehouse, supplier, laboratory and cold-chain systems by risk and any explicit authority or contract duty.
Confirm: A food-safety audit is not a cybersecurity audit.
Farms, agriculture and cold-chain operators
DubaiRegulator ruleAgriculture and food-safety rules, food transport and storage requirements. CIIP and UAE IA only if designated or directed.
Secure connected sensors, irrigation and control systems, temperature telemetry, warehouse systems and supplier links.
Pharmaceutical, chemical and food manufacturers with production systems
FederalRegulator ruleProduct, safety and GxP rules for your activity. PDPL where it applies. UAE IA and CIIP if designated.
Product-safety rules are not automatically cyber rules. Protect production, lab, quality and supply-chain systems. Check any explicit digital-control rule in your licence or customer contract.
Automation and managed-service suppliers to plants
FederalContract termCustomer contracts, privacy and security law, and any direct designation.
Contracts can require secure remote support, MFA, logging, incident notice, patch management and supplier evidence. Read your actual contract.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
61%
Of manufacturing breaches involved ransomware (Verizon 2026 DBIR, Manufacturing snapshot)
What changes for a manufacturer
The same security decision gets a different answer once a production line and a customer deadline are in the picture.
What to patch first
Internet-facing systems first. Plant systems wait for a maintenance window, so segmentation and access limits protect them until then.
Usual adviceEverything critical, on a monthly cycle.
Who to protect first
Engineers with controller access, equipment makers’ remote-support accounts, and the help desk that can reset them.
Usual adviceDomain and cloud administrators.
How to rank suppliers
By what they can touch on the floor, and by what a late delivery from them or to your customers would cost.
Usual adviceBy spend, or by the data they hold.
What downtime costs
Lost output, scrapped batches and missed orders. Agree which line restarts first and what can run by hand.
Usual adviceA recovery time in hours for each system.
What a customer asks
Evidence on demand: certificates, audit reports and answers about plant networks and remote access.
Usual adviceA questionnaire once a year.
What a plant asks us first
0of 4 done. Whatever is left is where we start.
If you also operate in the US, the UK, India or Australia
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
United States
- USCMMC Program (32 CFR Part 170) and DFARS CMMC ruleDefense suppliers that handle federal contract or controlled unclassified information must meet a CMMC level named in the contract. Level 2 maps to 110 NIST SP 800-171 requirements. The DFARS rule took effect November 10, 2025.
- 72hoursCIRCIA reporting rule (proposed)Proposed; not yet final. As proposed, covered critical infrastructure entities would report covered cyber incidents within 72 hours and ransom payments within 24 hours.
United Kingdom
- UKProduct Security and Telecommunications Infrastructure Act 2022, security regulationsIn force since 29 April 2024. Makers, importers and distributors of consumer connectable products must avoid default passwords, publish a security contact, and publish how long updates will be provided.
- UKCyber Essentials (NCSC)A UK certification scheme built on five technical controls. Many buyers ask suppliers to hold it before they bid. Cyber Essentials Plus adds independent technical testing.
India
Australia
- AUCyber Security Act 2024: smart device security standardIn force from 4 March 2026. Makers and suppliers of consumer smart devices sold in Australia must meet baseline rules, such as no default passwords and a way to report vulnerabilities, and issue a statement of compliance.
- 72hoursCyber Security Act 2024: ransomware payment reportingBusinesses with annual turnover above A$3 million, and operators of critical infrastructure assets, must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of paying.
- 30daysPrivacy Act 1988: Notifiable Data Breaches schemeCovers organisations and agencies under the Privacy Act. Assess a suspected breach within 30 days. If it is likely to cause serious harm, tell the OAIC and the people affected.
Standards that follow your data, not your sector
Card, privacy, resilience and assurance standards reach a manufacturer through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
- Law
- Card brand rule
- Buyer requirement
- Voluntary certification
- Law
NIS2
EU Network and Information Security Directive 2
EU sites making medical devices, electronics, machinery or vehicles can fall in scope.
Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.
Source: European Commission, NIS2 Directive - Law
GDPR
EU General Data Protection Regulation
You have an EU establishment, or sell to and monitor people in the EU.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679 - Card brand rule
PCI DSS
Payment Card Industry Data Security Standard
Only if you take card payments, for example from online or dealer sales.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards Council - Buyer requirement
SOC 2
AICPA System and Organization Controls 2
Only if you also sell cloud or connected-product services.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of services - Voluntary certification
ISO/IEC 27001
Information security management systems
Some customers ask suppliers to show it.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001
Where we would start with a manufacturer
Protect What MattersProtect What MattersLock down remote access and engineering workstations that reach the lines, and separate the office from the plant.Identity & Access Security, Security Architecture, Firewall Professional ServicesDetect, Respond & RecoverDetect, Respond & RecoverTest how fast one plant restarts after ransomware, from clean backups, in the order the customer orders need.Ransomware Recovery, Recovery & Restoration, Resilience TestingSecure & ComplySecure & ComplyGather what customers ask for, then map ISO/IEC 27001 and IEC 62443 to the plant.Third-Party & Supply-Chain Risk, Compliance Assessments, Control Design & Implementation
What to read before you talk to us
Industry BriefIndustry Brief: Manufacturing Cyber Risk PrioritiesWhy plant systems are the hardest to patch and how an office incident ends up on the floor.
Industry BriefIndustry Brief: Energy and Utilities Cyber Risk Priorities
Threat IntelligenceRansomware and Data Extortion: What Has Changed
Practitioner Field NotePlaybook: Testing Ransomware Recovery
Practitioner Field NotePlaybook: Assessing a Critical Supplier
ArticleThird-Party Risk Beyond the Questionnaire
Sources and method. This page is analysis, not legal advice.
- Verizon, 2026 DBIR Manufacturing snapshot (NAICS 31-33)
- Sophos, The State of Ransomware in Manufacturing and Production 2025 (press release, 332 manufacturers hit by ransomware)
- Dragos, 2026 OT Cybersecurity Year in Review
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE Legislation portal)
- UAE Government portal, Critical Information Infrastructure Protection (CIIP) Policy document
- UAE Government portal, Critical Information Infrastructure Protection Policy (page)
- ISO, ISO/IEC 27001:2022
- ISA, ISA/IEC 62443 series of standards
- NIST, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- DESC Information Security Regulation and Standards
- DESC Critical Information Infrastructure identification
- UAE Information Assurance standard
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection
- UAE Legislation portal
- Federal Law No. 10 of 2015 concerning Food Safety
- Dubai Municipality food traders and establishments / Food Code