Connected manufacturing environments create an interesting cybersecurity challenge for engineering and security teams: systems designed to manage business information increasingly interact with systems that control physical operations.
A corporate application may exchange production data with a manufacturing execution system, while engineering workstations communicate with PLCs and SCADA platforms. Remote maintenance and cloud analytics can introduce additional connections.
The result is an environment where IT and operational technology (OT) security must be considered together.
Start With Asset Discovery
Before implementing controls, teams need to understand what exists in the environment.
An industrial asset inventory should include, where relevant:
- PLCs and industrial controllers.
- SCADA and distributed control systems.
- Engineering workstations and operator interfaces.
- Industrial switches, routers, and network gateways.
- Manufacturing applications and connected databases.
- Remote access services and third-party connections.
The inventory should also identify system owners, criticality, communication dependencies, and operational constraints.
Without this information, teams may struggle to prioritise security investments or understand how a compromised endpoint could affect production.
Map Activities to NIST CSF 2.0
NIST CSF 2.0 provides six Functions that can organise a security programme:
- Govern: Define ownership, policies, risk tolerance, and oversight.
- Identify: Document assets, dependencies, and cybersecurity risks.
- Protect: Apply access controls, segmentation, and secure configurations.
- Detect: Monitor relevant systems and identify suspicious behaviour.
- Respond: Define escalation, containment, and communication procedures.
- Recover: Plan restoration of systems and critical production processes.
These Functions describe cybersecurity outcomes rather than prescribing a single technical architecture.
Design Controls Around OT Constraints
Security teams should avoid assuming that all industrial equipment can be patched, scanned, or restarted like ordinary IT endpoints.
Before conducting intrusive testing or making configuration changes, teams should consider vendor guidance, production schedules, safety requirements, and the consequences of downtime.
Network segmentation, controlled remote access, least-privilege permissions, logging, and carefully planned monitoring can help reduce exposure.
NIST SP 800-82 is a valuable complementary resource for understanding OT security considerations.
Build Repeatable Monitoring and Response
Detection should account for industrial protocols, expected operating patterns, critical system dependencies, and unusual access activity.
Incident response plans should specify who investigates alerts, who can authorise containment, and how cybersecurity decisions are coordinated with production and safety personnel.
Recovery procedures should identify critical systems, dependencies, backups, and restoration priorities.
For teams developing an organised NIST CSF 2.0 implementation, these practices provide a way to connect governance objectives with practical engineering workflows.
The goal is to create a repeatable security programme that reduces risk while respecting the availability and safety requirements of industrial systems.
Top comments (0)