Essential manufacturing cybersecurity checklist for small businesses

Small manufacturers are now prime targets for cyberattacks, not just large enterprises. Ransomware groups actively exploit operational technology (OT) environments because production downtime creates enormous pressure to pay quickly. At the same time, regulatory obligations like protecting Controlled Unclassified Information (CUI) add compliance layers that feel overwhelming when you're running a lean operation. This checklist-driven article cuts through that complexity, giving you a prioritized, framework-backed path to stronger cybersecurity and audit-ready compliance without requiring a full in-house IT department.

Table of Contents

• Start with baseline protections: CISA Performance Goals
• Inventory your OT assets: Foundation for robust security
• Expand controls: NIST guidance for manufacturing OT
• Track advisories and hardening: Stay ahead with CISA and vendors
• Address compliance: NIST SP 800-171 for CUI protection
• Checklist wisdom: What most manufacturers miss
• Next steps: Strengthen your manufacturing cybersecurity
• Frequently asked questions

Key Takeaways

Start with baseline protections: CISA Performance Goals

Every practical cybersecurity effort needs a starting line. For small manufacturers, that starting line is CISA's Cross-Sector Cybersecurity Performance Goals (CPGs). These goals are streamlined, outcome-driven baseline protections designed for both IT and OT environments, specifically intended to help small and medium-sized organizations get started. Think of the CPGs as a floor, not a ceiling. They tell you what you must accomplish before anything else.

The CPGs cover areas including account security, device security, data security, vulnerability management, and supply chain risk. Each goal is actionable and measurable, which is exactly what a checklist needs to be useful. You're not being asked to interpret vague policy language. You're being asked to check whether specific protections exist and work.

CISA also provides OT/ICS-related guidance and tools, including the Cyber Security Evaluation Tool (CSET), which allows you to evaluate your environment against the CPG baseline. CSET walks you through structured questions about your network, assets, and controls, then generates a report identifying gaps. It's free and well-suited for operations without dedicated security analysts.

• Review each CPG category and assign an owner within your team
• Download and complete the CISA CPG tracking worksheet to document current status
• Prioritize gaps in account security and device patching first, since these yield the fastest risk reduction
• Use CSET to generate a gap report and turn it into your first project backlog
• Revisit the CPG baseline every quarter, because threats and guidance both evolve

"The CPGs are a floor, not a ceiling. Meeting them is the beginning of a defensible posture, not the definition of one."

Pro Tip: Before tackling every CPG category at once, focus on account security controls first. Weak or shared passwords and missing multi-factor authentication (MFA) account for a disproportionate share of successful breaches in manufacturing environments. Fixing them costs very little but reduces risk significantly.

For a broader overview of where cybersecurity fits within your overall operation, the cybersecurity guide for manufacturers provides helpful context. If you want a deeper look at security fundamentals specific to your environment, IT security for manufacturers is a strong companion resource.

Inventory your OT assets: Foundation for robust security

Once the baseline is identified, the next step is knowing exactly what you need to protect. You cannot defend what you cannot see, and in manufacturing, the asset landscape is more complex than a typical office environment. You have programmable logic controllers (PLCs), human-machine interfaces (HMIs), engineering workstations, industrial switches, historians, and more. Each represents a potential entry point.

CISA emphasizes that creating and maintaining an OT asset inventory with an OT taxonomy is foundational for building a modern defensible architecture in OT environments. An OT taxonomy simply means categorizing your assets by type, function, and criticality, so you can make smarter decisions about where to invest protection efforts.

Here's how to build your OT asset inventory in a structured way:

1. Walk the floor physically. Start with a manual walkthrough of your production environment. Document every device connected to your operational network, including older equipment that may not appear in any IT asset management system.
2. Collect asset details. For each device, record the manufacturer, model, firmware version, IP address (if applicable), communication protocols used, and the process it supports.
3. Classify by criticality. Assign a criticality tier. Tier 1 might be devices whose failure stops production entirely. Tier 2 might be devices that reduce capacity. Tier 3 might be monitoring or auxiliary equipment.
4. Document network connections. Note which assets communicate with each other and whether any have connections to your IT network or the internet.
5. Assign ownership. Every asset should have a named owner responsible for patching, monitoring, and change management decisions.

Pro Tip: Use a spreadsheet at first if dedicated OT asset management software is out of reach. A well-maintained spreadsheet reviewed monthly beats a sophisticated tool that nobody updates. Accuracy matters more than the tool you use to store the data.

The manufacturing network security guide goes deeper into how asset visibility connects to network segmentation, a critical control once your inventory is in place. You can also cross-reference your inventory work against the 2026 network security checklist for additional structure.

Expand controls: NIST guidance for manufacturing OT

With inventory in place, owners can apply deeper controls and keep their checklist relevant. The Natural Institute of Standards and Technology (NIST) Special Publication 800-82 is the core reference for OT security in industrial environments. NIST SP 800-82 covers everything from risk management and network architecture to incident response and recovery specific to OT settings. A revision is currently underway that incorporates lessons learned from recent incidents and aligns with the updated NIST Cybersecurity Framework (CSF 2.0), reflecting how fast the threat landscape changes.

Where the CISA CPGs give you the minimum threshold, NIST SP 800-82 gives you the architecture. Think of it this way: CPGs tell you to lock the door; 800-82 tells you how to design the building so that locking the door actually works.

Key steps for expanding controls using NIST SP 800-82 guidance:

• Map your current controls against the NIST 800-82 framework sections most relevant to your production environment, starting with network architecture and access control
• Identify which gaps represent the highest operational risk, not just the highest compliance risk
• Create a remediation roadmap with realistic timelines, since OT patching often requires planned maintenance windows
• Review your checklist against 800-82 whenever NIST releases updated guidance or when your OT environment changes significantly
• Engage your equipment vendors to understand what security configurations they support and recommend

Manufacturers that treat their checklist as a living document rather than a one-time project see measurably better outcomes during audits and after incidents. The checklist should grow as your understanding grows.

For practical guidance on applying these controls to your network infrastructure, the practical guide for OT network security provides actionable steps aligned with these frameworks.

Track advisories and hardening: Stay ahead with CISA and vendors

Even strong controls become outdated. Maintaining vigilance means acting on the latest recommendations, and the fastest way to do that is monitoring CISA's advisory feed. CISA's ICS Advisories page publishes security advisories covering vulnerabilities in industrial control systems, OT devices, and IoT equipment, including mitigation recommendations from the vendors themselves. These advisories are published regularly and represent real, actively exploited vulnerabilities affecting equipment that may be running in your facility right now.

"Advisories are not background reading. They are action items. When CISA publishes a critical advisory for a PLC vendor you use, your response time is part of your security posture."

Here's how to build advisory tracking into your regular process:

• Subscribe to CISA ICS advisory email notifications so new advisories arrive in your inbox automatically
• Review each advisory against your OT asset inventory to determine whether your equipment is affected
• Prioritize advisories rated Critical or High, and document your response: patched, mitigated, or accepted with documented rationale
• Contact vendors directly when an advisory recommends vendor-specific hardening steps that require configuration changes
• Update your checklist to include new controls or verification steps identified through advisories

Vendor hardening guides are equally important. Most major PLC and SCADA vendors publish security hardening documents for their products. These guides recommend specific configuration settings that reduce attack surface, such as disabling unused communication ports, enabling authentication on engineering interfaces, and restricting remote access methods. Many of these settings are not enabled by default, which means equipment shipped from the factory may be more exposed than you realize.

Building advisory review into a monthly security meeting, even a short one, keeps your checklist current and your team informed. The proven cybersecurity steps resource offers additional structure for building a recurring security review habit across your organization.

Address compliance: NIST SP 800-171 for CUI protection

Manufacturers with compliance duties must map checklist actions to regulatory controls and documented evidence. If your operation handles Controlled Unclassified Information (CUI), which is common when working with federal agencies or defense contractors, NIST SP 800-171 is the standard you need to meet. NIST SP 800-171 Revision 3 provides an overview primer specifically intended to help small businesses understand and begin implementing its requirements in nonfederal systems.

The standard organizes requirements into control families. Each family addresses a specific domain of security, and your checklist needs to produce both implemented controls and documented evidence that those controls work.

1. Access Control (AC): Limit system access to authorized users and processes. Checklist items include reviewing user accounts quarterly, enforcing least privilege, and documenting access approvals.
2. Audit and Accountability (AU): Maintain logs of user activity and system events. Checklist items include enabling logging on all systems that touch CUI, storing logs securely, and reviewing logs for anomalies.
3. Configuration Management (CM): Establish and maintain baseline configurations for systems. Checklist items include documenting approved configurations and reviewing changes through a formal change management process.
4. Incident Response (IR): Develop and test a plan for responding to security incidents. Checklist items include a written IR plan, defined roles, and at least one tabletop exercise per year.
5. Risk Assessment (RA): Periodically assess risk to your systems and data. Checklist items include an annual risk assessment and documentation of findings and remediation actions.

Pro Tip: Compliance evidence does not need to be elaborate to be effective. A dated spreadsheet showing who reviewed user accounts and what changes were made is legitimate audit evidence. Consistency and documentation matter more than the sophistication of your tools.

Additional resources for compliance-focused manufacturers include the manufacturing compliance guide and practical guidance on data protection solutions that address both regulatory and operational needs.

Checklist wisdom: What most manufacturers miss

Here's an uncomfortable truth about checklists: checking a box is not the same as building a defense. The manufacturers who struggle most with cybersecurity are often the ones who treat their checklist as something to be finished rather than something to be maintained.

The most common mistake we see is a static checklist. It gets built once, perhaps after an audit scare or a close call with ransomware, and then it sits untouched until the next crisis. Meanwhile, new vulnerabilities emerge, OT assets get added or changed, and the threat landscape shifts. The checklist becomes a record of what was true eighteen months ago, not what is true today.

The second most common mistake is skipping the asset inventory. Teams jump straight to controls because controls feel productive. But applying controls without a complete asset inventory is like installing deadbolts on some doors while leaving others wide open. You're working hard, but the gaps you don't know about are the ones that hurt you.

The third mistake is treating compliance as the finish line. Meeting NIST SP 800-171 requirements or satisfying a customer audit is important, but compliance describes a minimum legal threshold, not an optimal security posture. Adversaries don't read your compliance reports before deciding whether to attack. Threat actors target whatever is accessible, regardless of whether you have documentation on file.

What works is treating cybersecurity as an operational discipline, the same way you treat equipment maintenance or quality control. You schedule it. You assign ownership. You track it over time. You update it when conditions change. The deeper manufacturer checklist insights resource explores this mindset in more detail and can help frame cybersecurity as a continuous operational practice rather than a project with an end date.

Next steps: Strengthen your manufacturing cybersecurity

Moving from checklist theory to real-world implementation requires more than good intentions. It requires consistent execution, specialized expertise, and systems that keep running even when threats emerge.

Symmetry Network Management works specifically with small manufacturers to implement and monitor the controls described in this article. From managed IT services that provide 24/7 monitoring and endpoint protection, to implementation support for critical security controls aligned with CISA and NIST frameworks, the team brings manufacturing-specific expertise to every engagement. Reliable backup testing and business continuity planning ensures that even if an incident occurs, your production data and operations can recover quickly. Schedule a free assessment to identify gaps and build a practical, prioritized roadmap for your operation.

Frequently asked questions

What is the first cybersecurity step for a small manufacturing business?

The first step is applying CISA's Performance Goals, which provide a streamlined, outcome-driven baseline covering both IT and OT environments and are designed specifically to help small organizations get started.

How often should a manufacturing cybersecurity checklist be updated?

It should be reviewed at least quarterly and updated whenever major advisories are published, since NIST's revision work explicitly incorporates evolving lessons learned and shifts in the OT threat landscape, confirming that static checklists quickly become outdated.

Why is an OT asset inventory important for cybersecurity?

An OT asset inventory is the foundation for every other control because CISA identifies it as essential for building a defensible architecture and because auditors require documented evidence of what systems exist and how they are protected.

How do I address CUI protection in my manufacturing checklist?

Use NIST SP 800-171 Revision 3 to map each control family to specific actions in your environment, then document your implementation and evidence so you're audit-ready at any point in the year.

Where can I find trustworthy advisories for my manufacturing OT environment?

CISA's ICS Advisories page publishes up-to-date vulnerability advisories and vendor-provided mitigation recommendations covering ICS, OT, and IoT equipment used across manufacturing environments.

Recommended

• Cybersecurity guide for U.S. small manufacturers
• Proven cybersecurity steps for small U.S. businesses
• Why IT security is essential for small manufacturers today
• How to secure manufacturing networks: A practical SMB guide