# Manufacturing OT cybersecurity

> Production lines, robotic cells, batch systems and plant utilities for discrete and process manufacturers. Downtime is measured in units lost per minute, and the line was never designed to be patched.

Canonical: https://blackbirdcyber.com/sectors/manufacturing  
Blackbird Cyber · https://blackbirdcyber.com/ · sales@blackbirdcyber.com

## The exposure — Ransomware reaches the line through the office.

Most plant outages from cyber incidents start on the business network and cross into production because the two were never separated. Engineering workstations, MES servers and vendor laptops bridge the gap every day.

Regulations and guidance: IEC 62443, NIST CSF, CMMC.

- IT and OT separation at the MES boundary
- Engineering workstation and project file control
- Recovery plans for PLC logic and recipes

## Typical topology

A representative control network for manufacturers, by Purdue level:

- L3.5 · DMZ: Plant DMZ
- L2 · HMI: Line HMI
- L2 · SCADA: MES / SCADA
- L2 · Historian: Production historian
- L1 · PLC: Cell PLC
- L1 · RTU: Robot controller
- L1 · Safety: Safety PLC
- L0 · Process: Conveyors · robots · drives · utilities

Exposed path: vendor VPN → L2 · Historian (Production historian).

## Where we start — Recommended engagements for manufacturers.

- [OT Network Architecting](https://blackbirdcyber.com/capabilities/ot-network-engineering): Segmented control networks designed and built to keep the process running.
- [OT Cyber Audit](https://blackbirdcyber.com/capabilities/ot-cyber-audit): A site-level assessment of control system exposure, ranked by consequence.