Industry Brief: Manufacturing Cyber Risk Priorities

Why manufacturing is a different risk problem

NIST defines operational technology as the programmable systems and devices that monitor or control physical processes: industrial control systems, building automation, transportation systems, physical access control and similar. Securing them has to respect performance, reliability and safety requirements that ordinary IT does not carry. A patch that is routine on a laptop may need a planned shutdown on a production line, or may never be applied at all.

That creates a condition peculiar to manufacturers. The systems that earn the revenue are often the least patchable, the least visible and the most dependent on enterprise IT for scheduling, identity and data. An incident that starts on the corporate side can therefore end on the factory floor, even when the plant systems themselves were never attacked directly.

The priorities at a glance

1. The IT/OT boundary and remote access

NIST SP 800-82 Rev. 3 covers OT architecture and topology, the threats and vulnerabilities common to OT, and recommended countermeasures. The ISA/IEC 62443 series sets out requirements for securing industrial automation and control systems across their lifecycle, and is built on shared responsibility among asset owners, system integrators and product suppliers. In practice, the approach most plants take from it is to group assets into zones and connect those zones only through controlled paths.

The weak points in that picture are usually the paths that were added for convenience: a vendor’s remote support connection, an engineering workstation that is also on the corporate network, a directory trust that extends into the plant. Each is a route from the enterprise estate to the line. A useful test is whether the business can list every remote access path into its plants as easily as it can list its firewalls.

Decision: agree what is permitted to cross between IT and OT, route every crossing through a controlled and monitored point, and give vendor remote access a named owner.

2. Production continuity and restart

The cost of an incident is driven heavily by how long production stays down. Consider the reporting on Jaguar Land Rover. A cyber attack led the company to suspend production at its UK factories for several weeks. Public reporting gave little technical detail about what failed, and this brief does not speculate. The lesson sits elsewhere: when the enterprise estate is unavailable, a plant may not be able to schedule, release or ship, whether or not its machinery is intact.

The question for leaders is what minimum viable production looks like. Which products can be built, at what rate, with which systems, and which of those systems depend on the corporate directory, the ERP or the manufacturing execution layer? That list shows how much of the plant is really independent. Restart also has a sequence: which systems come back first, and on what basis anyone trusts them.

Decision: define minimum viable production for each major site, then rehearse restart on the assumption that enterprise IT is unavailable.

3. Supplier and customer dependency

The Jaguar Land Rover reporting also shows what a shutdown does to the people around it. The supply chain was described as mostly small and medium-sized firms employing around 120,000 people, with unions and politicians warning that small suppliers could fail without support. The UK government agreed to back a loan of up to £1.5bn to help the company keep paying them.

Two points follow for a manufacturer’s risk view. First, supplier resilience is a financial question as much as a technical one: a supplier without cash reserves cannot survive weeks of lost orders. Second, dependency runs in both directions. The company needs its suppliers, and its customers’ lines may need the company. Most third-party reviews look in only one direction.

Decision: tier suppliers by whether their failure stops production, test the critical ones against a multi-week disruption, and understand what your own outage does to the customers who depend on you.

4. OT asset visibility and exposure

A plant often cannot say with confidence what is connected to it. Devices installed years ago, equipment maintained by the manufacturer, and systems that cannot be touched during production all contribute to a picture that is partly guesswork.

In our view, passive discovery is usually the safer first step, because actively probing fragile controllers can cause the very disruption the program is meant to prevent. Where a device cannot be patched, the answer is compensating controls: segmentation, restricted access and monitoring, with the unpatched condition recorded and accepted at the right level.

Decision: fund a safe inventory of OT assets before buying further controls, and set a risk-acceptance process for devices that cannot be patched.

5. Intellectual property and design data

Manufacturers hold designs, process parameters, recipes and tooling data that competitors and state actors value. That information moves: to suppliers for quotation, to partners for co-development, to contract manufacturers. Every sharing arrangement creates another place it can leak from.

The starting point is a short list of the intellectual property that would damage the business most if lost, and a map of where each item lives and who holds a copy. Without that, protection is spread thinly across everything.

Decision: identify the crown-jewel IP, record every external party that holds it, and decide which of those relationships need stronger controls.

A note for manufacturers with EU operations

The EU’s NIS2 Directive lists several manufacturing activities among its other critical sectors, including computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment, and certain medical devices. Whether it applies to a given entity depends on its size and activity and on national transposition. Manufacturers with EU operations should confirm their position with legal counsel rather than assume either way.

Decisions to put in front of the executive team

• Define what may cross between IT and OT, and bring remote access paths under one owner.

• Set minimum viable production for each major site and rehearse a restart without enterprise IT.

• Tier suppliers and customers by dependency, and test the critical ones against a multi-week outage.

• Fund safe OT asset discovery and a formal risk-acceptance route for unpatchable devices.

• List the intellectual property that matters most and every outside party that holds it.

What this brief does not claim

The priority order is a judgment based on published standards and reported incidents. It is not a measurement of any manufacturer’s position. Plants differ widely: discrete assembly, process manufacturing and regulated production each weight the priorities differently, and the reported incident cited here is described only as far as public reporting allows.

Sources

• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (NIST)

• ISA/IEC 62443 series of standards (ISA)

• Government to guarantee £1.5bn loan to JLR after cyber shutdown (Express & Star)

• NIS2 scope visual: sectors of high criticality and other critical sectors (Centre for Cybersecurity Belgium)