Managed IT · Manufacturing
How small manufacturers protect shop-floor machines, keep ERP running, recover from outages and answer customer security requirements.
Separate office and shop-floor networks
Plan for ERP downtime before it happens
Answer customer security questionnaires
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
IT support for a small manufacturing company has to protect production, not just the office. That means four priorities: separating shop-floor systems from the office network, keeping the ERP and production software running, backups and recovery plans measured in hours, not days, and meeting the security requirements your customers put in contracts, including CMMC for defense suppliers.
The shop floor is where manufacturers differ from other businesses. Machine controllers, PLCs and the PCs that run CNC programs or inspection equipment often run old operating systems that cannot be patched or replaced without the machine vendor. You protect them mainly by isolating them. The rest of this article explains how, and what to look for in an IT provider.
In May 2025, CISA and partner agencies published five primary mitigations for operational technology, the systems that run physical processes. In plain terms for a small plant:
Segmentation is the single biggest step. Ransomware that lands on an office laptop through a phishing email should not be able to reach the machine that cuts your parts.
Many plants run equipment controlled by a PC on an operating system that is years out of support. Replacing it can mean replacing a machine worth far more than the PC. Practical steps:
CAD models, CNC programs, work instructions and customer drawings are often the most valuable data in the building, and the easiest to copy.
The ERP system is where orders, inventory, purchasing and shipping meet. When it stops, so does planning. Whether it runs on a server in your building or as a hosted service, plan for:
Our systems integration team connects ERP with CRM, accounting and web apps, and our backup and disaster recovery guide covers recovery planning in more depth.
Want a clear view of your plant’s IT risks? Manufacturers often discover forgotten remote connections and untested backups only after an outage. Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, business continuity and technology spending, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Larger customers increasingly send security questionnaires and add cybersecurity clauses to purchase agreements. Typical questions cover multi-factor authentication, endpoint protection, backups, incident response and how you protect their drawings and specifications.
If you supply the Department of Defense, directly or through a prime contractor, the Cybersecurity Maturity Model Certification program applies. The program rule took effect on December 16, 2024, and the DFARS rule that puts CMMC requirements into contracts took effect on November 10, 2025, starting Phase 1, which relies on self-assessments. Phase 2, which would have required third-party assessments for many contracts starting November 10, 2026, was suspended on July 13, 2026 pending a review of the program, and as of early October 2026 no new schedule had been announced. The suspension did not remove existing obligations: Phase 1 self-assessments and affirmations in the Supplier Performance Risk System (SPRS) still apply, and DFARS 252.204-7012 still requires suppliers that handle Controlled Unclassified Information to protect it using the controls in NIST SP 800-171. Check your required level and the current status with your prime contractor and the DoD CIO’s CMMC resources, because the schedule may change again. This is general information, not legal advice.
Even if you never touch defense work, NIST SP 800-171 is a useful checklist for protecting customer drawings and specifications. NIST’s Manufacturing Extension Partnership also offers cybersecurity resources and local centers that help small manufacturers assess their risk.
JLB USA provides managed IT for companies with roughly 25 to 100 employees, including vendor management, security, monitored backups with tested restores and a written recovery plan. We reply within 5 minutes by email or phone, with on-site help in Atlanta, Birmingham and Chattanooga and remote support everywhere else.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Network separation between office and shop floor, ERP uptime, backups with tested restores, controlled vendor remote access and help with customer security requirements.
So an infection on an office computer cannot reach production machines. CISA lists segmenting IT and OT networks among its primary mitigations for operational technology.
It applies to Defense Department contractors and subcontractors, including small ones. The required level depends on the information you handle. Phase 2 third-party assessments were suspended in July 2026, but self-assessments and NIST SP 800-171 obligations still apply. Confirm with your prime contractor and counsel.
Inventory them, isolate them on the production network, block internet access, control USB use and keep an image so you can rebuild them quickly.
At least quarterly, by restoring the database to a test system and confirming it opens and the data is current.
