OT Cyber Security for UK Manufacturers: A Practical Guide

OT cyber security is the practice of protecting the operational technology that runs a factory floor: the programmable logic controllers, industrial control systems, sensors and machines that physically make things. For years these systems sat on their own island, unconnected and largely ignored by IT security. That island has gone. As plants connect machines to the network for monitoring and efficiency, the same attackers who hit office IT can now reach the equipment that keeps production running, and a good OT cyber security programme is what stops a phishing email in accounts from ending up as a stopped production line.

This guide is written for UK manufacturers, from a 30-person engineering shop to a multi-site producer, and it explains the risk in plain terms, the controls that actually reduce it, and how all of this now feeds into your cyber insurance.

Why manufacturing is a prime target

Manufacturing has been the most attacked sector globally for four years running, taking roughly a quarter of all recorded incidents, with ransomware against factories climbing sharply through 2025. The reason is simple economics: a manufacturer that cannot ship has a very short tolerance for downtime, which makes it more likely to pay a ransom quickly. Older machinery running unsupported software, engineers who need remote access, and a culture that has always prized uptime over patching all widen the opening.

The damage is rarely subtle. A ransomware infection that spreads from the business network into the OT environment can halt every line at once, spoil work in progress, and take days or weeks to recover because the control systems have to be rebuilt and revalidated before anything is allowed to move again.

IT and OT are not the same problem

The single biggest mistake is to treat the factory like a bigger office. IT security prioritises confidentiality: keeping data secret. OT security prioritises availability and safety: keeping the process running and keeping people from being hurt by a machine doing the wrong thing. You cannot simply push an automatic patch or reboot a controller in the middle of a production run, and a security tool that is fine on a laptop can crash a twenty-year-old PLC.

This is why IT/OT convergence, the trend of joining these two worlds onto one network, is both the source of the efficiency gains and the source of the risk. Connecting them without controls gives an attacker a clear road from the internet all the way to the machines.

Segment the network: the Purdue model

The most important control in OT cyber security is segmentation: keeping the office network and the factory network apart, with tightly controlled crossings between them. The reference framework here is the Purdue model, which divides an industrial environment into levels, from the physical sensors and actuators at the bottom (Levels 0 and 1), through the control and supervisory systems (Levels 2 and 3), up to the business IT systems at the top (Levels 4 and 5).

A flat network, where a PC in the office can talk directly to a controller on the line, is the condition most attackers rely on. The practical goal is to place a controlled boundary (often a demilitarised zone) between IT and OT, and to segment inside the OT network so that a problem on one line cannot spread laterally to the rest. You do not need to rebuild the plant overnight, but you do need to know every device, how they are connected, and where the crossings are. A full asset inventory is the honest starting point, and it usually surprises people.

The controls that matter most

Beyond segmentation, a handful of measures do most of the work:

• Know what you have. Maintain a live inventory of every OT asset, its firmware version and its network connections. You cannot protect what you have not mapped.
• Control remote access. Vendor and engineer remote access is the classic way in. Route it through a monitored, multi-factor-protected jump host, never a modem or an always-on connection left over from an installation.
• Enforce least privilege. Separate OT accounts from IT accounts, remove shared logins, and make sure a compromised office password cannot log into a controller.
• Patch on a realistic schedule. You cannot patch a factory like an office, but you can patch during planned maintenance windows and mitigate the rest with segmentation and monitoring.
• Back up control logic offline. Keep offline, immutable copies of PLC programs and configurations so a line can be rebuilt after an incident. Test that you can actually restore them.
• Monitor OT traffic. Passive monitoring built for industrial protocols will flag a device suddenly talking to something it never has before, which is often the first sign of trouble.
• Have a plan for a stopped plant. Rehearse who does what when production halts, including how you run manually and who you call.

For the wider set of measures that apply to your whole business, see our cyber security checklist for UK businesses and our guide to running a cyber security risk assessment.

The standards and rules to know

You do not have to invent an OT security programme from scratch. The international standard IEC 62443 is the recognised reference for securing industrial automation and control systems, and it is the one most manufacturers and their suppliers now point to. NIST 800-82 covers similar ground and is widely used alongside it. In September 2025 the UK’s National Cyber Security Centre and the US CISA issued joint guidance on securing OT systems, and the NCSC’s own operational technology guidance is a sound, free place to start. On the regulatory side, expanded UK network and information systems rules are tightening obligations on more organisations, so it is worth checking whether your firm or your customers fall in scope.

How OT security affects your insurance

Cyber insurers underwriting a manufacturer will increasingly ask OT-specific questions: is IT segmented from OT, how is remote access controlled, are control-system backups held offline, and is there an incident plan for a production stoppage. Weak answers mean a higher premium, a lower limit, or a business-interruption exclusion that leaves the most expensive part of an incident, the lost production, uninsured. Strong answers do the opposite. Getting the controls above in place is not only good engineering, it is how you keep cover affordable and make sure a claim actually pays. To understand what a policy does and does not cover, read what cyber insurance actually covers and our overview of cyber insurance for UK small businesses.

Frequently asked questions

What is the difference between IT and OT security? IT security protects data and prioritises confidentiality. OT security protects the physical process and prioritises availability and safety, because you cannot let a control system stop or misbehave without risking production or people. The tools, timescales and priorities are different, even though the two now share a network.

What is the Purdue model in OT cyber security? It is a reference framework that divides an industrial environment into levels, from physical devices at the bottom to business IT at the top, and it guides how you segment the network so that an attacker cannot travel straight from the office to the machines. It is the basis for most factory network segmentation.

Which standard should a UK manufacturer follow for OT security? IEC 62443 is the most widely recognised standard for industrial control system security, and it pairs well with ISO 27001 for management systems. The NCSC and CISA joint OT guidance is a practical, free companion for smaller firms getting started.

Can ransomware really stop a factory? Yes. If ransomware spreads from the business network into an unsegmented OT environment, it can halt every line at once and force a full rebuild of the control systems before production restarts. Segmentation and offline backups are what limit that damage.

Does cyber insurance cover a production stoppage? Business interruption from a cyber incident can be covered, but insurers now scrutinise OT controls closely and may exclude or limit it if segmentation, remote access and backups are weak. The stronger your OT security, the better the cover and the more likely a claim pays.