For most manufacturers, the compliance driver is not a single regulator. It is a mix of customer requirements flowing down the supply chain, contract clauses from defense or automotive primes, insurers asking about ransomware resilience, and in some regions sector cybersecurity law. Underneath all of that is a technical reality: production networks that were once isolated are now connected to ERP, remote vendor support, and cloud analytics, so a phishing email in the office can stop a line.
Why OT needs its own approach
IT and OT priorities compared
Those differences are why copying an IT control set onto the plant rarely works. Compensating controls, such as segmentation, application allowlisting, and tightly controlled remote access, often stand in for patching. Documenting that reasoning is as important as the control itself, because an auditor or customer will otherwise read an unpatched HMI as a failure rather than a managed risk.
Standards and obligations manufacturers encounter
Zones, conduits, and where to draw lines
IEC 62443 asks you to group assets with similar security requirements into zones and to control every communication path between them, called conduits. In practice most teams start from a Purdue-style layering: enterprise IT at the top, a demilitarized zone for historians and patch servers, site operations, supervisory control, and basic control devices at the bottom. The first deliverable is usually a network diagram of those zones with every conduit listed, its owner, and what traffic it permits. That diagram then drives firewall rules, remote access design, and the scope of any assessment.
Defense suppliers and CMMC
- Level 1 covers basic safeguarding of Federal Contract Information under FAR 52.204-21, with an annual self-assessment and affirmation.
- Level 2 covers Controlled Unclassified Information and aligns with the 110 requirements of NIST SP 800-171 Rev 2. Depending on the contract, it is verified by self-assessment or by a certified third-party assessment organization every three years.
- Level 3 adds selected requirements from NIST SP 800-172 and is assessed by the government, for suppliers of the most sensitive programs.
- CMMC requirements are being phased into DoD contracts over several years, so primes are already flowing expectations down to their subcontractors. The CMMC framework page covers the levels in more depth.
Supplier risk runs in both directions
Manufacturers are both customers and suppliers. Upstream, equipment vendors and integrators often hold persistent remote access to production systems, and a compromised component supplier can halt output. Downstream, your own customers send questionnaires and contract clauses. A tiered approach, described in our vendor risk program guide, keeps effort proportional: deep review for vendors with OT access or single-source status, lighter review for everyone else.
Controls worth prioritizing for OT supplier access
- Remote access through a managed jump host or secure access service, never direct inbound connections
- Vendor accounts that are named, time-limited, and enabled only for the maintenance window
- Session logging or recording for vendor sessions into control systems
- Contract terms covering incident notification and vulnerability disclosure for supplied products
- Alternate suppliers or spare parts identified for critical components
A realistic sequence and the pitfalls to avoid
- Build an asset inventory covering both IT and OT, including firmware versions and vendor support status.
- Use NIST CSF 2.0 to structure the program and report to leadership across both environments.
- Segment OT from IT and lock down remote access before investing in anything more advanced.
- Write and test a business continuity plan that assumes a ransomware event on the IT side forces OT to run isolated.
- Pursue ISO 27001 or CMMC where customers or contracts require it, and apply IEC 62443 practices to the plant.
In Asurvo, ISO 27001, NIST CSF 2.0, NIST SP 800-171, and CMMC 2.0 are available as live frameworks with automated cross-mapping, and teams can load their own internal control libraries or custom frameworks alongside them. Supplier inventory, tiering, and questionnaires run in the Third Party module, and continuity and incident plans sit in the policy center with review cycles.