The short answer
Manufacturing cyber security protects three things: office IT, shop-floor operational technology (OT) and the connected products you make. For most UK manufacturers the starting point is Cyber Essentials or Cyber Essentials Plus, asked for by customers and defence primes, followed by safe OT testing and, for product makers, the UK PSTI regime and the EU Cyber Resilience Act.
On this page
- Which manufacturing cyber security standards apply to you?
- Do manufacturers need Cyber Essentials Plus?
- Are factory systems in Cyber Essentials scope?
- What should OT and product testing cover?
- What do defence primes and the MOD ask suppliers for?
- How can manufacturers limit ransomware downtime?
- What do PSTI and the Cyber Resilience Act mean for product makers?
- Why Sovereign Secure
- Next step
Manufacturing cyber security covers three areas: the office IT that runs orders, design and finance; the operational technology (OT) on the shop floor, such as PLCs, HMIs, SCADA and engineering workstations; and, for many firms, the connected products you sell. Customers usually set the agenda. Prime contractors, public sector buyers and the MOD ask suppliers for Cyber Essentials or Cyber Essentials Plus, and product makers now face the UK’s PSTI regime and the EU Cyber Resilience Act.
This page summarises each obligation and links to the page that covers it in full.
Which manufacturing cyber security standards apply to you?
Most manufacturers face two or three of these, depending on who you sell to and what you make.
| What triggers it | What is usually asked for | Where we cover it |
|---|---|---|
| Customers, prime contractors and UK central government contracts | Cyber Essentials or Cyber Essentials Plus, plus security questionnaires; PPN 014 requires Cyber Essentials for many central government contracts | Cyber Essentials Plus |
| MOD contracts carrying DEFCON 658 | Controls set by the contract’s Cyber Risk Profile, which can be evidenced through Defence Cyber Certification | Defence Cyber Certification Levels 0 and 1 |
| Consumer connectable products sold in the UK | The PSTI regime: no universal default passwords, a way to report vulnerabilities and a stated minimum security update period | IoT and hardware testing |
| Products with digital elements sold in the EU | The EU Cyber Resilience Act: reporting since 11 September 2026, full requirements from 11 December 2027 | EU Cyber Resilience Act guide |
| Medium and large EU subsidiaries in NIS2 manufacturing sectors, such as machinery, electronics, electrical equipment, vehicles and medical devices | Risk management and incident reporting under national NIS2 laws | NIS2 guide |
| Larger customers and group policy | ISO 27001 certification, sometimes alongside ISO 9001 | ISO certification |
Many manufacturers also hold management system standards that sit alongside the security ones, and because they share the same clause structure they can run as one integrated system. We offer ISO 9001 consultancy for quality management, support for ISO 14001 certification for environmental management and ISO 45001 certification for health and safety, and ISO 50001 energy management, which can be your route to ESOS phase 4 compliance when the certificate covers at least 95% of your energy consumption. If quality management is new to you, start with what ISO 9001 is.
Some standards depend on what you make. Medical device manufacturers and their component suppliers are often asked for ISO 13485, and food and drink manufacturers for ISO 22000 food safety management; we provide consultancy for both. Where plant reliability and capital planning drive performance, ISO 55001 asset management covers how production lines, plant and site utilities are maintained and renewed.
Do manufacturers need Cyber Essentials Plus?
Not by law, but often by contract. Basic Cyber Essentials is a self-assessment questionnaire marked by a certification body. Cyber Essentials Plus adds a hands-on audit: an assessor tests a sample of your devices, internet-facing systems and cloud accounts within three months of the basic certificate. If a customer’s contract or supplier portal says “Cyber Essentials Plus”, basic certification will not satisfy it.
Our Cyber Essentials packages start at £320 + VAT and are priced by staff numbers. Cyber Essentials Plus is quoted after scoping, because the price depends on the device builds and sites to be sampled.
Are factory systems in Cyber Essentials scope?
Some of them. The NCSC’s Requirements for IT Infrastructure v3.3 apply to in-scope devices and software that can accept connections from the internet, make outbound connections to it, or control the flow of data between the two. A sub-set, meaning part of the organisation whose network is segregated by a firewall or VLAN, can be used to define what is in or out of scope, as long as you justify it to the assessor.
| Shop-floor asset | Usually in scope? | What to do before assessment |
|---|---|---|
| Office laptops, CAD and engineering workstations | Yes | Standard builds and 14-day patching for high and critical updates |
| Shop-floor PCs and HMIs that browse, email or reach cloud services | Yes | Treat them like any other desktop: supported OS, anti-malware, no shared logons |
| Machines on unsupported operating systems, such as an old CNC controller PC or test rig | Only if they can reach the internet | Move them into a sub-set that blocks all internet traffic, or replace them |
| PLCs and controllers on a segregated OT network with no internet route | Not if the boundary is agreed as a sub-set | Document the firewall or VLAN boundary and its rules |
| Supplier and machine-builder remote access accounts | Yes, accounts you own are in scope even when a third party uses them | Unique credentials, MFA where available, disabled when not needed |
| Cloud services such as ERP, MES and file sharing | Yes, cloud services cannot be excluded | MFA on every user account |
Agree the boundary first: our Cyber Essentials scoping questionnaire records your sites, devices and internet-facing services, and we confirm the scope before any assessment. A Cyber Essentials Plus audit is not an OT test: it runs an external scan and tests a sample of in-scope devices and cloud accounts for patching, malware protection, MFA and admin account separation.
What should OT and product testing cover?
Start at the boundary between office IT and the shop floor, because a compromised office network is the usual route to the line. A typical manufacturing engagement looks at three layers:
- The IT to OT boundary. Firewall rules, jump hosts and remote access paths that could let an office compromise reach the line.
- The devices. Firmware, debug interfaces, radio links and authentication on controllers, gateways and the connected products you sell.
- The back end. The cloud services, APIs and companion apps that devices talk to.
Older controllers can fail under active scanning, so techniques, test windows and any use of spare or lab units are agreed with your engineers before testing starts. Our IoT and hardware penetration testing page covers the method and what is included.
What do defence primes and the MOD ask suppliers for?
MOD contracts that carry DEFCON 658 make cyber security a contract condition. The MOD assesses each contract’s cyber risk and assigns a Cyber Risk Profile, the requirements flow down to subcontractors, and suppliers can evidence the controls through Defence Cyber Certification (DCC), a scheme the MOD developed with IASME as its Certification Authority. Every level builds on Cyber Essentials, so basic certification alone is not enough where a contract sets a Cyber Risk Profile or DCC level.
We are listed on IASME’s Network Directory as a certification body for Defence Cyber Certification Levels 0 and 1, and we certify the Cyber Essentials that every level builds on. Level 0 is the level the MOD has asked all industry partners to reach by 31 December 2026; Level 1 covers contracts with a low to moderate risk profile. Our page on Defence Cyber Certification for MOD suppliers sets out the levels, the controls each adds and how certification works. If your contract sets Level 2 or 3, you need a certification body listed for that level, and we can still certify the Cyber Essentials Plus it requires.
Shop-floor systems count. IASME’s DCC scope covers the functions your organisation needs to operate, so operational technology that production depends on is in scope, although an assessor may accept compensating controls where a control cannot be applied to OT. Civil primes in aerospace, automotive and engineering set their own supplier requirements, so read the clause in your contract or supplier portal before choosing a certificate.
How can manufacturers limit ransomware downtime?
When order systems, MES or engineering file shares are encrypted, production can stop even if the machines themselves are untouched. Make UK’s Cyber Security in Manufacturing report (August 2026) found that 30% of manufacturers had a cyber incident in the past year, directly or through their supply chain, and that only around half have an incident response plan. The controls that shorten downtime are mostly about separation and recovery:
- keep IT and OT on separate networks, so an office infection cannot spread to the line;
- hold offline or immutable copies of PLC programs, recipes, CAD files and MES configuration, and test restoring them;
- require MFA on remote access and cloud services, and remove supplier access when it is not in use;
- apply high and critical security updates within 14 days, as Cyber Essentials requires;
- write and rehearse an incident response plan that covers the shop floor as well as office IT, starting from our incident response plan template.
Our guide to preventing ransomware sets out the full plan.
What do PSTI and the Cyber Resilience Act mean for product makers?
If you make connected products, security is now a condition of sale. In the UK, the PSTI product security regime has applied to consumer connectable products since 29 April 2024. It bans universal default passwords and requires a published way to report security issues and a stated minimum period of security updates.
In the EU, the Cyber Resilience Act, Regulation (EU) 2024/2847, covers hardware and software products with digital elements placed on the EU market, including those made by UK firms. Our EU Cyber Resilience Act guide explains the requirements. We are not a notified body; our role is the firmware, interface and back-end testing that feeds your technical documentation.
Why Sovereign Secure
- IASME-licensed certification body. We assess and issue Cyber Essentials and Cyber Essentials Plus certificates, and certify Defence Cyber Certification at Levels 0 and 1 for MOD suppliers.
- Hardware, IoT and OT testing alongside network, cloud, web and mobile penetration testing, with safety rules agreed before testing starts.
- ISO consultancy for the standards manufacturers often hold, including ISO 9001, 14001, 45001 and 50001, with certification audits by our partner certification body, MQA International.
- ISO 27001 certified, with UK headquarters in Accrington, Lancashire.
Next step
Complete the Cyber Essentials scoping questionnaire for a fixed Cyber Essentials or Cyber Essentials Plus quote, or use the enquiry form on this page to scope OT, IoT or product testing, or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
