Cyber Security for Manufacturers: Rules, Risks, Costs

A contract machine shop with 60 people on two shifts gets an email from its largest customer's supplier quality group. There is a new clause in the next purchase order, four letters long, and somebody has to answer it by Friday. Nobody at the shop carries a security title. IT is a two person managed services provider that keeps the ERP running and the shop floor PCs patched when it remembers.

That is the real shape of this problem. The sector is not short of security advice. It is short of an answer to three specific questions: which rules actually bind us, what is likely to hit us, and what does the first year cost. This page answers those three using the sector's own numbers rather than general ones, drawn from Verizon's manufacturing breakout, the FBI's complaint data, the Department of Defense's published cost estimates, and the trade association's count of how big a typical US manufacturer really is.

Why Cyber Security for Manufacturers Is Different

Three things separate a factory from an office, and each one changes what security has to do.

The first is that the loss is production. A law firm that loses a day of email has a bad week. A plant that loses a day of scheduling, machine programs or shipping has missed a delivery window, and the penalty for that sits in a contract. Verizon's manufacturing breakout names the late 2025 ransomware attack on Asahi Group Holdings, which forced a shutdown of the company's domestic manufacturing facilities and a suspension of shipments, and points out that the financial impact reached far past the extortion demand into operational downtime and downstream supply chain disruption. That is the pattern the sector should plan against.

The second is that nobody regulates most of it. There is no federal cyber security rule for a company that makes valves or cabinets or seat frames, no equivalent of HIPAA's Security Rule sitting over the industry. What binds a manufacturer is a customer contract, an insurance condition, and, for a large slice of the sector, defense acquisition rules that arrive as a flowdown clause from somebody upstream. Parts of the sector do sit inside critical infrastructure policy: CISA's Critical Manufacturing Sector covers primary metals, machinery, electrical equipment and transportation equipment, and warns that disruption of certain elements could affect essential functions at the national level and across other infrastructure sectors. That designation brings help and information sharing, not a compliance deadline.

The third is size. The National Association of Manufacturers, citing the Census Bureau's Statistics of U.S. Businesses, counts 239,265 manufacturing firms in 2022, of which all but 4,177 have fewer than 500 employees, with around three quarters below 20 employees and 93.1 percent below 100. The mental image of manufacturing as a handful of enormous companies is wrong, and the security advice written for those companies fits almost nobody in the sector.

What Regulations Apply to Manufacturing Cyber Security

The honest answer has two branches, and which branch you are on decides your budget.

If nothing you make touches a federal defense contract at any tier, no cyber security regulation applies to you as a manufacturer. State breach notification laws still apply to the employee and customer personal information you hold like any other business, product safety and export control rules still apply to what you ship, and your customers' security questionnaires still apply commercially. But there is no auditor coming.

If any part of your revenue traces back to the Department of Defense, including as a third or fourth tier supplier, the picture changes completely. Two instruments do the work. DFARS clause 252.204-7012 requires adequate security on covered contractor information systems, applies the security requirements of NIST SP 800-171, obliges the contractor to report a cyber incident to the Department within 72 hours of discovery, to preserve system images and packet capture data for 90 days, to submit isolated malicious software to the DoD Cyber Crime Center, and to include the same clause in subcontracts involving covered defense information. Sitting on top of it, the Cybersecurity Maturity Model Certification program turns the self-attestation into a graded status that gates award.

The dates matter more than the acronyms. The program rule was published in October 2024. The acquisition rule that puts the clause into solicitations, DFARS Case 2019-D041, took effect on November 10, 2025, and it phases in. For the first three years the clause appears only where a program office decides to apply a CMMC requirement to a particular contract. From three years and one day after that date, it is prescribed wherever a contractor's own systems will process, store or transmit federal contract information or controlled unclassified information.

What Data Manufacturers Hold That Attackers Want

The sector's data profile is genuinely unusual, and it explains why generic advice misses.

In Verizon's 2026 manufacturing snapshot, covering NAICS 31 to 33 across a dataset running from October 2024 through November 2025, internal business data appears in 81 percent of the sector's breaches. Credentials appear in 26 percent, other data in 22 percent, and personal information in only 17 percent. Compare that with a retailer or a clinic, where the personal records are the whole point. What leaves a manufacturer is emails, plans, drawings, quotes, process documents and the contents of a support or engineering ticket system.

That difference shows up again in motive. Financial motive covers 87 percent of manufacturing breaches, which is unsurprising. Espionage covers 15 percent, which is not. A meaningful minority of intrusions into this sector are after the product rather than the payment, and a stolen design has no expiry date. A card number is cancelled in an afternoon. A tooling drawing, a formulation, a set of machine parameters or a bid package stays valuable for the life of the product, and the company usually never learns it was copied.

Defense suppliers hold a third category on top of both. Controlled unclassified information is not classified, which is exactly why it lives in ordinary email, ordinary file shares and ordinary quoting systems, and why the government wrote a rule about protecting it in systems it does not own.

The last piece of the profile is people. External actors account for 95 percent of the sector's breaches and internal ones for 5 percent, so the insider case is the exception rather than the rule, but it is the exception that access reviews and offboarding exist for, and in a business with contractors, seasonal shifts and a high turnover shop floor it is not zero.

The Cyber Attacks That Actually Hit Manufacturers

Manufacturing gets attacked the way it does because of how its systems are exposed, not because criminals have a special interest in metalwork. Three findings in the sector data are worth acting on.

The first is the way in. Across the whole 2026 DBIR dataset, exploitation of vulnerabilities became the leading initial access vector at 31 percent of breaches. In manufacturing it is higher: 38 percent, against phishing at 13 percent and credential abuse at 11 percent. The sector's characteristic weakness is an internet facing system nobody has patched, not an employee clicking a link. That is a budget instruction. A patching program somebody actually owns buys down more of this sector's risk than another round of training does, though both belong on the list.

The second is the outcome. Malware appeared in 75 percent of manufacturing breaches, with ransomware accounting for 61 percent, against 48 percent of breaches across all industries. Hacking actions were present in 71 percent, with use of stolen credentials and exploitation of a vulnerability each contributing to 41 percent. Social engineering is the sector's second most common pattern but a distant third as an action, present in 16 percent of breaches, of which phishing makes up 77 percent and pretexting 18 percent. Three patterns, system intrusion, social engineering and basic web application attacks, cover 91 percent of the total.

The third is the supplier. Third party involvement appears in 61 percent of manufacturing breaches, against 48 percent across the full dataset. Manufacturing runs on other companies: contract IT, machine builders with remote support, EDI and portal connections into customers, ERP hosted somewhere else. Each one is a legitimate path in, which is what makes a supply chain attack so effective here and so slow to detect.

How OT and ICS Security Differs From IT Security

Operational technology is the part of a manufacturer that a security tool built for laptops does not understand. NIST defines it in SP 800-82 Revision 3 as the broad range of programmable systems and devices that interact with the physical environment, industrial control systems among them, and says plainly that securing them has to respect performance, reliability and safety requirements that IT systems do not carry.

Those constraints are not an excuse, but they are real. A vulnerability scan that a file server shrugs off can knock a programmable logic controller offline. A patch that takes ten minutes on a laptop needs a validated maintenance window and, for regulated product, requalification. A controller bought in 2009 has a supported life measured against the machine it drives, which is thirty years, not against an operating system support calendar, which is ten. Replacing it is a capital project.

So the work starts somewhere unglamorous. CISA, with the EPA, NSA, FBI and five international partners, published asset inventory guidance for OT owners in August 2025 that puts the case in one line: without an inventory, an organization does not know what it has and what should be protected. The guidance sets out five phases and 14 high priority attributes to collect first, including asset criticality, communication protocols, IP address, operating system and physical location. For most manufacturers, producing that list honestly is the single largest security improvement available, because it turns an argument about tools into a plan about specific machines.

The second piece is the boundary. Ransomware reaches production equipment because a path exists between the office network and the plant network, most often through a flat network, a shared domain, a jump box everyone uses or a vendor's remote support tunnel.

What Manufacturing Cyber Security Costs

For defense work there is an unusually good answer, because the government published its own estimate rather than leaving it to vendors.

That last line is the number that matters, and it is the one no competitor page tells you. The published cost is the cost of proving it, not the cost of doing it. A supplier that has been posting an SPRS score below 110 with a standing plan of action, which describes a great many of them, is looking at the assessment fee plus whatever it takes to close the gap between the score and 110. That second figure has no published estimate, because it depends entirely on how much was left undone.

For a manufacturer with no defense exposure, the budget question is the ordinary one, and the answer is the same short list any small business needs with two additions: an OT asset inventory and a segmentation boundary. The first costs time rather than money. The second is a network project, and it is the line item most often deferred because it does not produce a certificate.

How to Secure a Manufacturing Business

The FBI publishes its own mitigation list in the annual crime report, and it is a better starting point than most commercial frameworks because it is short and it is ordered by what actually stops the cases the Bureau sees.

When to Hire a Manufacturing Cyber Security Firm

Two purchases get confused here, and confusing them wastes a year. Readiness work, meaning the gap assessment, the system security plan, the remediation and the evidence, is advisory. A CMMC Level 2 certification assessment is performed by an authorized third party assessment organization, and the same organization cannot both build your controls and certify them, which is the same independence logic that separates readiness work from the audit in the commercial world.

Beyond compliance, the decision to hire turns on hours rather than knowledge. Detection has to happen at 3am, and no manufacturer with 60 employees staffs that, which is why continuous monitoring bought as a service is the usual answer for this sector rather than a hire. When you evaluate a firm claiming manufacturing experience, ask three questions and listen for specifics: which control platforms have you worked on by name, what do you do differently in a validated environment, and who on your team has stood on a plant floor during an incident. A firm that answers in general security language has office experience, which is worth having and is not the same thing.