A manufacturing security review should reconcile people, devices, business applications, engineering systems, production assets, network paths, external providers, data flows, and recovery dependencies. The goal is not a noisy vulnerability list. It is evidence of which weakness could alter product information, expose customer data, interrupt production, weaken quality records, enable fraud, or prevent recovery.
Coordinate plant and operational testing with authorized engineering, operations, maintenance, safety, quality, and equipment owners. Use passive evidence or a controlled maintenance window when active testing could affect equipment. Do not scan, patch, isolate, restart, or change a production asset only because an office-IT tool recommends it.
Evidence to collect before changing manufacturing IT and production technology
The review produces an owned inventory of IT and operational technology, identities, data, connections, vulnerabilities, exceptions, operational consequences, compensating controls, recovery requirements, and retest evidence. Findings are ranked by safety, product, shipment, financial, customer, and recovery impact.
- Current business, engineering, production, quality, network, endpoint, remote-access, backup, monitoring, and provider inventories with accountable owners.
- Identity, group, privilege, service-account, token, key, certificate, session, recovery, and external-access exports from systems that support them.
- Engineering release, ERP, MES, QMS, warehouse, maintenance, interface, error, audit, and change records for representative products and orders.
- Plant and office diagrams, allowed communication, firewall and remote-access rules, wireless and cellular paths, vendor appliances, and unsupported assets.
- Restore results, manual-operation procedures, incident exercises, support tickets, alert handling, risk acceptance, customer requirements, and corrective actions.
Reconcile assets, identities, systems, data, ownership, and operational impact
Asset, owner, function, and consequence inventory
What to check: Match discovered assets to accountable business and operational owners. Capture function, product or process dependency, communication, version, support status, backup, safety or quality consequence, and approved disposition for every exception.
What to do next: Assign owners, investigate unknown assets safely, correct records, document dependencies, restrict unmanaged paths, and create an approved plan for unsupported or high-consequence systems.
Identity, privilege, service account, and recovery control
What to check: List people and nonhuman identities with owner, purpose, role, privilege, MFA, source, last use, secret age, recovery, interactive access, dependencies, expiration, monitoring, and backup coverage.
What to do next: Disable unexplained identities after preserving dependencies, remove interactive or broad access, separate privileged use, rotate exposed secrets, protect recovery, assign owners and dates, and test normal and denied paths.
Engineering and production-record integrity
What to check: Sample active and historical work for revision, approval, release authority, local and emailed copies, superseded status, downstream synchronization, audit history, backup, and unauthorized-change detection.
What to do next: Correct releases and permissions, quarantine uncontrolled copies, reconcile affected systems, preserve history, limit release authority, improve alerts and distribution, and retest at the point of use.
Test engineering, business, production, quality, device, and network controls
ERP, MES, QMS, warehouse, and interface control
What to check: Trace representative orders and changes across systems. Capture ownership, field mapping, timing, validation, failure alerts, unresolved errors, privileged access, duplicate entry, and reconciliation evidence.
What to do next: Correct data and ownership, reduce unnecessary interface privilege, repair alerting and retry logic, reconcile affected records, document manual fallback, and test both successful and failed transactions.
IT and operational-technology network boundaries
What to check: Compare documented and observed communication with approved operational need. Capture internet exposure, broad rules, unmanaged pathways, unused services, alternate routes, weak administration, change history, and monitoring coverage.
What to do next: Coordinate approved segmentation and rule changes, close unnecessary exposure, secure administration, separate guest and office use, preserve required operations, document exceptions, and verify allowed and denied traffic.
Endpoint, shared station, removable media, and remote support
What to check: Match devices to function and owner and collect health, encryption where appropriate, protection, patch, local administrator, software, remote tool, media history where available, shared-user design, last seen, support status, and exception.
What to do next: Recover or isolate unknown systems safely, enroll and protect supported endpoints, remove unnecessary privilege and tools, restrict media, improve shared use, schedule operational changes, and document compensating controls for fixed dependencies.
Supplier, customer, provider, and machine-builder access
What to check: Find unnamed, always-on, broad, dormant, alternate, and expired paths. Capture business need, system scope, source, approval, session behavior, monitoring, credential ownership, data exchanged, end date, and closure test.
What to do next: Create named controlled access, narrow scope and time, use company-controlled entry, rotate credentials, close alternate paths, monitor high-impact sessions, document emergency use, and independently verify revocation.
Review external paths, backup, monitoring, incidents, requirements, and change
Backup, restoration, and alternate operations
What to check: Review successful jobs and failures, access separation, coverage, copy protection, compatibility, sequence, recovery objectives, vendor responsibility, recent isolated restores, operational validation, and manual-operation records.
What to do next: Close coverage gaps, protect copies and credentials, preserve versions and licenses, correct procedures and priorities, create alternate workflows, run isolated restores, obtain operational validation, and record results.
Monitoring, incidents, response authority, and return to service
What to check: Trace selected alerts and incidents from detection through ownership, operational assessment, containment, communication, evidence, recovery, validation, and corrective action. Record missing logs, stale contacts, unsafe assumptions, and untested decisions.
What to do next: Restore useful visibility, correct alert ownership and escalation, define operational authority, update contacts and scenarios, preserve evidence, conduct a tabletop, and verify corrective actions without unsafe production testing.
Customer obligations, risk acceptance, and technology change
What to check: Sample obligations and changes and capture scope, qualified interpretation, accountable approval, implemented control, evidence, expiration, customer representation, operational review, and post-change verification.
What to do next: Correct unsupported claims, clarify scope with qualified owners, assign missing controls, expire stale exceptions, assess new technology before connection, preserve evidence, and schedule review.
Prioritize risk by production and recovery consequence
Give leaders an action register with the affected product, process, site, system, data, operational consequence, immediate containment, safety or production coordination, permanent correction, owner, maintenance window, due date, evidence, and retest. Keep observations separate from verified facts and do not present an untested compliance conclusion.
Priority 1: Active production, safety, integrity, or financial threat
Act immediately on active malicious access, unsafe remote control, suspected engineering or recipe tampering, exposed privileged or payment authority, uncontrolled customer data, or a condition that could affect people, product, or current production.
Priority 2: Recovery and shipment continuity risk
Urgently address untested restoration, unsupported critical dependencies, failed interfaces, missing alternate procedures, single-person administration, or an outage path that threatens committed production or shipment.
Priority 3: Excessive access and unmanaged exposure
Correct stale identities, broad network routes, dormant vendor paths, unknown assets, local privilege, uncontrolled copies, weak monitoring, and overdue exceptions through approved operational change.
Priority 4: Efficiency and maturity
Improve automation, reporting, asset data, role templates, alert quality, support procedures, and lifecycle governance after active exposure and continuity risk are controlled.
Worked audit example: a green backup with an incomplete restore
This fictional audit sample concerns engineering job R-218 and its approved revision F. The recovery objective chosen for this example is four hours; it is not an industry requirement. The test runs in an isolated environment with no controller connection, machine command or production traffic. The table records a limited file restore and an unresolved application dependency, not a successful plant recovery.
| Audit check | Illustrative observation | Finding and next acceptance evidence |
|---|---|---|
| Choose the recovery set | The approved sample identifies the job's drawing, bill of materials, application configuration and backup timestamp. | Keep the sample manifest and owner approval; do not substitute an arbitrary readable file. |
| Restore into isolation | The listed files and configuration are recovered in 53 minutes and match the recorded sample identifiers. | File recovery passes for this sample. Retain restore logs and the manifest comparison. |
| Open the required workflow | The compatible engineering application cannot start because its recovery license is unavailable. | Operational acceptance fails. The application owner must resolve the license dependency and repeat the isolated test. |
| Assess the time objective | Only file recovery has been timed; the user cannot complete the approved engineering task. | The four-hour workflow objective remains unproven. Do not report 53 minutes as production recovery time. |
| Close the audit finding | A recovery owner and retest scope are assigned; production remains untouched. | Close only after the responsible owner validates the defined workflow and exclusions are recorded. Any return to production needs a separate authorized decision. |
NIST's OT guidance calls for planned backup coverage and verification alongside operationally controlled changes. The figures and failure in this table are illustrative acceptance criteria, not a measured customer result or an objective prescribed by NIST. [2]
Remove plant and engineering IT bottlenecks through controlled cleanup. Use the cleanup guide to turn an accepted audit finding into a bounded correction with dependencies, an operational owner and evidence of closure.
Official product documentation and ALLMSP resources
Frequently Asked Questions
What belongs in a manufacturing IT and OT asset inventory?
Record the asset’s identity, location, operational function, accountable owner, supported version and the product or process that depends on it. Add required communications, upstream services, recovery needs and the consequence of losing or altering it. Include supporting virtual systems and remote entry points, not just equipment with an inventory sticker. Mark unknown fields and how they will be verified. A count of discovered IP addresses alone is not an owned IT and OT inventory.
How should manufacturers review user and service-account access?
Compare approved duties with effective access, including groups, local accounts, service identities, keys, tokens and recovery paths. For a service account, identify the application or scheduled job, owner and credential dependency before proposing removal or rotation. Sample a required action and an inappropriate action using an authorized test. A current employee list does not explain a vendor token, inherited privilege or an automation identity that can still change production information.
What evidence shows that manufacturing teams are using controlled engineering information?
Trace one actual job from its released engineering record to what an ordinary user opens at the point of work. Compare part number, revision, approval, effectivity and linked work instructions across the relevant systems. Inspect how superseded copies are distinguished and who can release a change. Keep the sample and any mismatch as evidence; the presence of a document-control application does not prove that a local PDF or emailed drawing is current.
How can a manufacturer audit critical system integrations?
Select a representative transaction with a stable identifier and follow it through each system boundary. Compare source and destination values, timing, mappings, acknowledgment, error handling and reconciliation. Include an authorized failure or duplicate test in a safe environment, with a named person receiving the alert. State which transactions and fields were checked. A job schedule or successful connector status is not evidence that every order, quantity or revision reached its destination correctly.
What should an IT and OT network-security review verify?
Verify that each reviewed network path has a justified source, destination, service, owner and operating purpose. Compare the documented design with observed traffic and configuration, including alternate wireless, cellular and vendor routes. Check administration and monitoring separately from process communications. Use passive evidence and approved test arrangements for sensitive equipment; do not probe or block production merely to complete the audit. Record untested paths and the operational approval needed to examine them.
How should manufacturing endpoint reviews handle shared and production-linked systems?
Judge a station against its function and supported equipment dependencies. A shared production display, engineering workstation and office laptop may need different session, patch, media and protection arrangements. Confirm who owns the exception, what the vendor supports and how risk is reduced when a normal control cannot be used. Test required tasks with the responsible operational owner. An unsupported security agent or unplanned restart can create a new plant problem rather than close a finding.
What should a manufacturer verify about supplier and vendor remote access?
Verify who can enter, through which path, for which equipment and purpose, with whose approval and for how long. Include alternate appliances and credentials, not just the main VPN account. Examine session evidence and the procedure for emergency use and revocation. Test a reviewed closure through an authorized, non-disruptive method. Named access is useful evidence, but it does not by itself prove that an unused cellular route or shared credential has been removed.
How can manufacturers prove that backups will support production recovery?
Prove a defined recovery task with an isolated restore and operational acceptance, not just a green backup report. Check that the required data, application versions, configurations, licenses and credentials are available, then have the responsible owner validate a representative workflow. Record what was restored, what was excluded, elapsed time and remaining blockers. A partial engineering-file restore cannot establish a whole plant’s recovery time or authorize reconnection to live equipment.
What should a manufacturing incident-response review examine?
Follow a selected scenario from detection to the person authorized to assess production and safety consequences, approve containment, preserve evidence and authorize return to service. Check contacts, decision authority, required logs, recovery dependencies and the handling of unresolved findings. Use a tabletop or isolated exercise where live testing could affect operations. A generic instruction to disconnect an infected machine is insufficient when that machine supports a physical process.
How should manufacturers review technology against customer and regulatory requirements?
Map each applicable customer commitment or requirement to its scope, qualified interpreter, accountable owner, implemented control and retained evidence. Keep a verified condition separate from a policy statement or an unchecked supplier claim. Record exceptions, expiration or review triggers and the approval needed before a new technology is connected. Refer legal, safety and customer-specific interpretations to the responsible qualified owner; an IT checklist or a NIST reference alone does not establish compliance.
