Manufacturing Compliance

Regulations That Apply

Regulation	What It Covers
NIST CSF 2.0	Voluntary framework (final Feb 26, 2024) — often required by customers and insurers
ISO/IEC 27001:2022	Information security management — common customer requirement
NIST SP 800-82 Rev 3	Industrial Control Systems / OT security guidance
IEC 62443	Industrial automation and control systems security
Defend Trade Secrets Act	Federal protection for formulas, processes, and trade secrets
SEC Cyber Disclosure	If publicly traded — Item 1.05 of Form 8-K

What You Need In Place

• IT / OT network segmentation
• Asset inventory of OT and ICS devices
• Patch management with planned production downtime
• Privileged access management for engineers
• Backup of HMIs, PLCs, SCADA configurations
• Supply chain and vendor risk management
• Employee training including the shop floor
• Incident response with operational continuity planning

Common Threats In This Sector

Manufacturers are targeted both for the IT side (financial systems, BEC, ransomware) and the OT side (industrial control systems, production line disruption). The OT side is the higher-stakes attack surface and the one most small manufacturers underinvest in.

• Ransomware targeting operational technology (OT) and industrial control systems (ICS)
• Business email compromise on accounts payable and procurement
• Intellectual property theft — designs, processes, formulas, customer lists
• Supply-chain attacks via vendor portals and design-collaboration tools
• Phishing for ERP, MRP, and PLM system credentials
• Insider threat involving engineering access to export-controlled technical data

Documentation You’ll Be Asked For

Customer cybersecurity questionnaires drive most of the documentation demand in manufacturing — large OEMs increasingly require evidence before placing new orders. DoD supply chain status adds CMMC artifacts. NIST SP 800-82 Rev. 3 covers OT-specific guidance.

• CMMC artifact set (SSP, POA&M, SPRS score) if the firm is anywhere in the DoD supply chain
• OT and IT network segmentation documentation
• Customer-requested ISO 27001 or NIST CSF 2.0 mapping
• Vendor management documentation, especially for design partners and contract manufacturers
• Trade-secret protection policies and access-control evidence (relevant under the Defend Trade Secrets Act)
• Incident response plan including OT-specific scenarios and safe-shutdown procedures
• Export-control compliance documentation (ITAR / EAR) if applicable

Where Most Small Manufacturers Fall Short

The gaps in small-manufacturer security tend to cluster around the OT side, where IT security practices have been historically applied late or not at all.

• OT and IT networks not actually segmented — flat networks where ransomware spreads from office to plant floor
• No MFA on engineering systems or remote-access VPN
• Trade-secret marking and access controls are weak or unwritten
• No OT-specific incident response playbook; the IT plan does not cover production downtime
• Vendor security not reviewed for design partners or contract manufacturers
• Patching strategy that ignores OT/ICS endpoints because “they cannot be patched” — without compensating controls