Cybersecurity · Manufacturing
Why attackers favor manufacturers, how to separate shop-floor systems from office IT, and how to answer the security questions your customers now send.
Manufacturing tops attack statistics
Separate OT from office IT
Be ready for supplier audits
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Small manufacturers are attractive to attackers because downtime is expensive, older shop-floor systems are hard to patch, and customers depend on on-time delivery, so pressure to pay a ransom is high. IBM’s X-Force Threat Intelligence Index 2026 found manufacturing was the most attacked industry for the fifth year in a row, at 27.7 percent of the incidents IBM responded to in 2025.
The core defenses for a 25 to 100 person plant are: multi-factor authentication on email and remote access, backups that cannot be encrypted and are tested, a network that separates operational technology (OT) from office IT, controlled vendor remote access, and a written plan for running or restarting production during an incident. If you sell to defense or large OEM customers, expect formal security requirements in your contracts.
In the manufacturing incidents IBM’s 2026 report covered, exploiting public-facing applications was the most common way in (32 percent), followed by valid accounts (16 percent). In plain terms: unpatched internet-facing systems and stolen logins.
OT means the systems that run physical processes: PLCs, HMIs, CNC controllers, SCADA, building systems and the PCs that program them. NIST Special Publication 800-82 Revision 3 is the U.S. government’s main guide to OT security. Its central idea for a small plant is segmentation: keep OT on its own network zone and tightly control what crosses into it.
Recovery in manufacturing means more than restoring files. It means getting machines back to producing parts.
Our guide to backup and disaster recovery for small businesses covers recovery targets and testing in more depth.
Want to know how exposed your plant and office systems are? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Large customers increasingly send supplier security questionnaires, and some build requirements into purchase agreements. Expect questions about MFA, backups, endpoint protection, patching, incident response and who can access their drawings.
Defense suppliers face formal rules. The Department of Defense’s CMMC program began phase 1 on November 10, 2025, when contracting officers could begin adding CMMC requirements to new solicitations, starting with self-assessments. The CMMC program rule (32 CFR 170.3) schedules phase 2, which adds Level 2 third-party (C3PAO) certification assessments for many contracts involving controlled unclassified information, to begin November 10, 2026, followed by phase 3 in November 2027 and full implementation in November 2028. However, on July 13, 2026 the Department of Defense (also styled the Department of War) paused the phase 2 transition pending a program review, and as of early October 2026 no outcome had been announced, so the third-party assessment milestone is on hold. The program has not been cancelled: phase 1 self-assessments and SPRS affirmations, DFARS clause 252.204-7012 and the NIST SP 800-171 controls it requires remain in effect. Check the DoD CIO CMMC site for current status. If you handle defense work, confirm your required level with your prime contractor and qualified advisors now, because preparing for an assessment takes months.
NIST’s Manufacturing Extension Partnership (MEP) centers offer cybersecurity resources aimed at small manufacturers, and CISA’s StopRansomware site lists free guidance and services.
A one-hour tabletop exercise each year shows where your plan breaks. Gather the owner, plant manager, office manager and IT provider, and walk through a scenario: it is 6 a.m. Monday, office screens show a ransom note and the ERP will not load.
Write down the gaps you find, assign owners and fix the biggest ones first.
JLB USA’s cybersecurity services include multi-factor authentication, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores, a written recovery plan and help with cyber-insurance and customer questionnaires. Our managed IT covers office IT and vendor management for businesses with roughly 25 to 100 employees, with on-site support in Atlanta, Birmingham and Chattanooga and remote support everywhere else. For defense contracts, confirm requirements with your prime and a qualified assessor.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Downtime is costly, networks are often flat, shop-floor systems are hard to patch and customers depend on deliveries. IBM’s X-Force Threat Intelligence Index 2026 ranked manufacturing the most attacked industry for the fifth year in a row.
Keeping operational technology such as PLCs, HMIs and CNC controllers on its own network zone, with a firewall that allows only the specific connections needed between the plant floor and office systems.
Only if they hold or seek Department of Defense contracts that include CMMC requirements. Phase 1 began November 10, 2025. Phase 2, which adds third-party Level 2 assessments, was scheduled for November 10, 2026 but was paused on July 13, 2026 pending review; self-assessments, SPRS affirmations and DFARS 252.204-7012 / NIST SP 800-171 obligations remain in effect. Confirm your required level with your prime contractor and qualified advisors.
Isolate them on a separate network segment, block their internet access, limit USB use, use application allow-listing where possible, and plan replacement over time.
Only through access that is approved per session, protected with multi-factor authentication and logged. Always-on vendor connections are a common way attackers get in.
