Why Manufacturing Cybersecurity Starts on the Shop Floor
A compromised CNC program doesn't just create a data breach. It can interrupt production, turn good stock into scrap, expose intellectual property, or put an operator at risk.
Manufacturing was the most targeted industry in 2024, accounting for 26% of all cyber incidents tracked, according to IBM's X-Force Threat Intelligence Index 2025. The same report found manufacturers experienced more ransomware cases than any other sector.
This guide covers protecting CNC programs, Controlled Unclassified Information (CUI), engineering workstations, DNC/CNC communications, controllers, PLCs, HMIs, and the OT networks that connect them. It is written for U.S. manufacturers, not office IT teams.
We'll walk through:
- Identifying critical assets on the shop floor
- Applying controls that respect uptime
- Aligning with standards your customers may require
- Building a recovery plan before you need one
Key Takeaways
- CNC programs, offsets, tooling data, and CUI are controlled production assets—treat them accordingly, not as shared drive files.
- Map how files move between engineering systems, DNC servers, removable media, and machine controllers before adding controls.
- Segment IT and OT networks, restrict access by role, and lock down vendor remote connections.
- Protect program integrity with approval workflows, version control, and documented rollback steps.
- Use NIST and ISA/IEC guidance to structure your program, but confirm current contract and compliance requirements separately.
Why Manufacturing Cybersecurity Is Different From Office IT Security
Office IT security has one main job: keep data confidential. Shop-floor security has four jobs at once: confidentiality, integrity, availability, and physical safety. Those priorities don't always pull in the same direction.
Take a CNC controller running a critical job. Pushing a security patch might be the right IT move, but if it takes the machine offline mid-run, you've traded a theoretical risk for a real one: scrap, missed delivery, or a safety incident.
NIST's Guide to Operational Technology Security makes this explicit: OT logic directly affects the physical world, so unauthorized changes to instructions or alarm thresholds can damage equipment or endanger people. NIST notes that OT security typically prioritizes integrity and availability first, with safety as the overarching concern, the reverse of a typical office IT priority list.
Legacy Equipment Creates Real Constraints
Most shop floors run a mix of old and new. That means:
- Legacy CNC controllers running unsupported operating systems
- Proprietary communication protocols that weren't built with security in mind
- Narrow maintenance windows where patching is even possible
- Shared operator accounts across shifts
- Equipment designed decades before anyone considered internet connectivity
IT/OT Convergence Widens the Attack Surface
Modern shops tie systems into what used to be an isolated production floor:
- ERP, MES, and CAD/CAM
- Cloud storage and remote support tools
- Supplier VPNs and industrial Ethernet
- Wireless devices and USB drives
Each link is a potential entry point, and few of those paths were designed for shop-floor risk.
Map the Manufacturing Attack Surface Before Choosing Controls
You can't protect what you haven't inventoried. Before picking tools or policies, build a complete picture of what exists and how information actually moves.
Start with an asset inventory covering:
- CNC machines, controllers, PLCs, and HMIs
- DNC servers and engineering workstations
- File shares and MES/ERP connections
- Network switches, wireless access points, and backup systems
- Vendor connections and removable-media workflows
Trace the CNC Program's Full Lifecycle
Every program follows a path. Map it end to end:
- Creation or revision in CAD/CAM
- Engineering approval before release
- Transfer through a DNC or file server
- Delivery to the machine controller
- Operator use on the shop floor
- Quality verification and archival
- Controlled disposal when obsolete
Unmanaged transfer points are where the most damage happens: shared folders, USB drives, email attachments, and cloud sync.
Snavely's Machine runs 30-plus CNC machines and 10 control types across 40 operators. Getting the right program to the right machine cut the risk of mismatched or outdated files reaching the wrong control.
Classify and Rank by Consequence, Not Just Vulnerability
Separate sensitive data from routine administrative files:
- CUI and export-controlled data
- Intellectual property
- Production programs and machine parameters
Then rank assets by consequence of compromise:
- Safety impact
- Scrap and downtime
- Customer delivery risk
- Time to restore production
Assign an owner to every critical asset, repository, and remote-access method. Unknown assets can't be patched, monitored, or recovered. Unowned assets tend to stay unknown.
Protect CNC Programs, CUI and Machine Networks
This is where the practical work lands. Five controls cover most of the risk on a typical shop floor. 1. Establish program governance. Keep one authoritative CNC program version in circulation and make release a controlled step:
- Require engineering approval before any revision goes live
- Log who changed and released each file
- Restrict write permissions so operators can't pull an obsolete program
- Prefer workflows that push the latest approved file to the control, instead of asking operators to pick it 2. Protect files in transit. Treat every handoff as a trust boundary:
- Use authenticated access to program stores and DNC paths
- Encrypt connections where the equipment supports it
- Run integrity checks that flag altered or unexpected files
- Document how staff reject anything that doesn't match the approved version 3. Secure CUI specifically. If drawings, models, or process data include CUI, harden access around those files:
- Apply least-privilege permissions by role
- Use multifactor authentication where practical
- Encrypt CUI in transit and at rest
- Log every access or download event 4. Segment the network. Separate systems that don't need full mesh connectivity:
- Split enterprise IT, engineering, production-management, machine-cell, and safety networks into zones
- Allow only the cross-talk production actually needs
- Design segmentation so running machines stay up during an IT-side event 5. Lock down endpoints, removable media, and remote access. Close the paths attackers and honest mistakes both use:
- Scan removable media before use
- Apply device-control policies on shop-floor PCs and controls
- Require named accounts, time limits, and session logging for vendor or remote-support access
- Disconnect remote access as soon as maintenance ends A solid CNC/DNC workflow supports this structure. Controlink Systems LLC has built shop-floor software since 1998, including Machine Link™ and QUICK Serve, to distribute engineering-approved files straight to machine controllers instead of relying on manual transfers or USB sticks. That approach matches what shops see in practice. Ametek, Inc. reported that manually resending corrected files caused repeated errors; routing revisions through an engineering-review folder before release stopped the problem. Automated distribution reduces manual file movement and helps ensure operators run the current approved version. It is still one control among many, not a substitute for the full program above. Visibility makes the same controls easier to run at scale. A Dragos case study on Crown Holdings describes a global metal-packaging manufacturer that lacked real-time OT visibility and asset inventory across its sites. After adding OT asset identification, network mapping, and IT/OT monitoring, Crown reported faster incident response and simpler compliance reporting. The case study does not quantify downtime or scrap reduction, but it shows why inventory and segmentation belong in the same program as file control.
Align Controls With U.S. Standards and Customer Requirements
Standards give your program structure. They don't automatically prove you're compliant with any specific contract.
NIST Cybersecurity Framework (CSF) 2.0, published in February 2024, organizes work around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Use it to structure your program, not as a checklist that satisfies every customer's requirements on its own.
If your shop handles CUI under a federal contract, NIST SP 800-171 Rev. 3 (finalized May 2024) sets requirements for protecting that information's confidentiality on nonfederal systems.
CMMC requirements layer on top of this, and the rules have shifted. Phase II requirements were suspended in mid-2026 while Phase I self-assessment obligations remain in place. Verify current contract language and CMMC status with a qualified compliance professional before making any claims.
For OT-specific guidance, ISA/IEC 62443 addresses industrial automation and control-system security directly, including the zones-and-conduits model, defined roles for asset owners and integrators, and lifecycle management practices.
Compliance Isn't the Same as Security
Meeting a framework's practices doesn't automatically satisfy every customer, contract, or regulatory obligation. Keep these as living documents:
- System security plan and asset inventory
- Data-flow records and access reviews
- Incident-response procedures and supplier requirements
- Risk register and backup evidence
- Remediation plan with owners and dates
Questions worth asking before a customer or supplier review:
| Question | Why It Matters |
|---|---|
| What data is CUI? | Determines which safeguards apply |
| Where may it be stored? | Limits exposure across systems |
| Who may access it? | Enforces least privilege |
| How is remote access controlled? | Closes a common entry point |
| How are CNC programs approved and restored? | Confirms integrity controls |
| What evidence is required during an assessment? | Sets expectations before the audit |
Build a Shop-Floor Incident Response and Recovery Plan
Speed matters, but sequence matters more. People and production come first, then containment, then recovery.
Watch for these escalation triggers:
- An unexpected CNC program change
- Unexplained machine behavior
- A ransomware alert or suspicious login
- An unavailable DNC server
- An unauthorized USB device or abnormal network traffic
Contain Without Creating a New Hazard
Follow machine-safety procedures first. An unsafe emergency shutdown can cause more damage than the incident itself. Isolate affected systems with OT and operations input, preserve logs, and loop in your incident-response lead immediately.
For CNC-specific containment:
- Stop distribution of any questionable files
- Identify which machines and program versions are affected
- Preserve known-good programs in a separate location
- Disable compromised accounts or remote-access sessions
- Prevent propagation while keeping remaining operations safe
Norsk Hydro's 2019 ransomware incident is a useful reference point. Reporting from IndustryWeek described automated production lines shutting down and smelters switching to manual operation while the company worked to restore systems.
That episode is a reminder that offline procedures and manual fallback plans aren't optional extras.
Recover Only From Trusted Sources
Before resuming normal production:
- Restore from tested backups
- Validate controller configurations against approved programs
- Run first-article checks
- Get operations sign-off
Have a documented fallback for DNC outages: local copies, spare workstations, and a communication plan for customers and suppliers.
Run tabletop exercises with IT, OT, engineering, quality, maintenance, and operations at least once a year. Test whether the team can actually identify affected assets and restart safely, not just whether the plan exists on paper.
Frequently Asked Questions
What are the 7 types of cybersecurity?
Commonly cited categories include network, endpoint, application, cloud, IoT, mobile, and data security, though classifications vary by source. Manufacturing environments need an OT-specific approach layered on top of these categories.
What is manufacturing cybersecurity?
Manufacturing cybersecurity is the protection of manufacturing IT and OT systems, machines, industrial networks, production data, people, and processes from unauthorized access, disruption, manipulation, and data loss.
How can a CNC machine be protected from cyberattacks?
Use network segmentation, controlled access, secure file transfer, and approved-program workflows. Add removable-media controls, monitoring, backups, restricted vendor access, and patch only where it won't disrupt production.
How should manufacturers protect CUI on the shop floor?
Identify where CUI lives, apply least privilege and multifactor authentication, encrypt it in transit and at rest, and log access. Verify your approach against current contract language and NIST requirements.
What is the difference between IT and OT cybersecurity in manufacturing?
IT prioritizes data confidentiality first. OT must also preserve availability, process integrity, and predictable machine behavior, with safety as the overarching concern.
What should a manufacturer do if a CNC program or machine network may be compromised?
Protect personnel first, then follow your incident plan: stop distributing questionable files, isolate affected systems safely, and preserve evidence. Restore only from validated, known-good sources after IT/OT leadership approval.
