A Cybersecurity Checklist for Indian Manufacturing Companies

Manufacturing has become one of the most targeted sectors, and the reason is straightforward: the cost of downtime is measured in hours of production, so the pressure to pay a ransom is immediate. At the same time, plant networks often grew up separately from corporate IT and were never treated as an attack surface.

This checklist is ordered by impact. Work top to bottom.

1. Find out what is actually on your plant network

You cannot protect devices you do not know about. In most plants an asset inventory reveals machines nobody documented, including some with remote access still enabled from an old support contract.

Do this: a passive discovery scan of the plant network. Passive matters – active scanning can disrupt sensitive controllers.

2. Separate plant from office

If a compromised office laptop can reach a PLC, you have a production risk sitting on a desk. Segmentation is usually the highest-value control in a plant, and it rarely requires replacing equipment.

• Define which flows genuinely need to cross between IT and OT.
• Allow only those flows, through a monitored point.
• Deny everything else.

3. Deal honestly with legacy equipment

You will have machines running unsupported operating systems. They cannot be patched. The realistic answer is containment rather than replacement:

• Isolate them on their own segment.
• Restrict who and what can reach them.
• Monitor for unusual behaviour, since you cannot fix known vulnerabilities.

4. Control remote vendor access

Support contracts often come with remote access that persists long after the contract ends. Every one of those is a door.

Do this: inventory every remote access path into production equipment. Disable the ones you cannot justify. For the rest, require approval per session and log it.

5. Test that your backups actually restore

Manufacturers are commonly hit with ransomware that seeks out and encrypts backups first. An untested backup is an assumption, not a control.

• Keep at least one copy offline or immutable.
• Restore something real, on a schedule, and time it.
• Know how long a full production recovery would take – that number drives your ransom decision.

6. Patch the corporate side properly

The usual route into a plant is not a sophisticated OT attack. It is a phished office account or an unpatched internet-facing server, followed by lateral movement.

Patch operating systems and browsers, remove software nobody uses, and enable multi-factor authentication on email and VPN – email first.

7. Give the plant floor a way to report problems

Operators often notice odd behaviour – a screen that changes on its own, an unexpected prompt – and say nothing because there is no channel. A two-minute reporting route and a no-blame response is one of the cheapest controls available.

The vendor access problem

Ask any plant manager how many external parties can reach production equipment and the honest answer is usually a guess. Machine vendors, integrators, the original equipment manufacturer and the maintenance contractor all tend to be given access during commissioning, and that access quietly persists afterwards.

This is one of the most common routes into a plant. Not a sophisticated attack on a controller – a forgotten support account with a weak password that nobody has reviewed since installation.

What to do: list every remote access path, note who holds it and why, and disable everything you cannot justify in writing. For what remains, require approval per session and log the session. If a vendor objects to that, the objection itself is informative.

Why patching the plant is different from patching the office

You cannot simply apply updates to a production line. A patch may change behaviour, void a warranty, or require a maintenance window that costs more in lost output than the vulnerability costs in risk.

That is why segmentation matters more in manufacturing than in most sectors. If you cannot fix the equipment, you constrain who can reach it and watch what it does. Compensating controls replace patching where patching is not possible.

The practical split is:

• Office and corporate systems – patch promptly. This is where attackers usually enter.
• Servers supporting production – patch on a scheduled maintenance cycle with tested rollback.
• Controllers and embedded equipment – isolate, restrict access, monitor. Do not patch unless the vendor supports it.

Proving it to your customers

Large manufacturers increasingly audit their suppliers. If a customer sends a security questionnaire and you cannot answer basic questions about network segmentation or backup testing, that becomes a commercial problem rather than a technical one.

Documentation produced as part of normal operations – asset lists, change records, restore test logs – answers most of a supplier questionnaire without additional effort.

Frequently asked questions

Will a security scan stop our production line?

Not if it is done correctly. Passive discovery and read-only assessment do not disrupt controllers. Anything intrusive is scheduled in a maintenance window with your production team.

Do we have to replace old machines to be secure?

Usually not. Segmentation, restricted access and monitoring around legacy equipment achieves most of the risk reduction at a fraction of the cost of replacement.

Where do we start with a limited budget?

Asset inventory and IT/OT segmentation, in that order. Both reduce real risk and neither requires buying much.

Next step

A plant network assessment will tell you what is exposed and what to fix first. See our manufacturing practice or get in touch on +91 97315 99227.