The new safety protocol: Manufacturing sharpens focus on cybersecurity

For those who work on or near a factory floor, safety protocols have long been a critical priority; appropriate eyewear and steel toe boots are often essential protection around machinery and production lines.

But manufacturing safety has evolved well beyond the physical. As manufacturers become more interconnected—combining traditional IT functions, Internet of Things devices and operational technology on the factory floor—strong cybersecurity measures and thorough risk management are paramount. Further, companies can learn lessons and draw parallels between physical safety and cybersecurity for personnel who have long understood the value of safety but don’t yet see the value of cybersecurity.

“For industrial companies, cybersecurity is the new safety,” says David Carter, an RSM industrials senior analyst. “And as more companies move their data centers into the cloud, it's changing the way they operate.”

Companies need to think holistically about cyber risks to build cyber resilience. That means integrating cybersecurity risk management into the broader scope of enterprise risk management, rather than allowing it to exist in its own silo.

“Some manufacturing leaders might be of the mindset that because manufacturers don’t handle large quantities of personally identifiable information—the way health care or consumer products companies do, for instance—they are at lower risk for a cyberattack,” says Carter. “On the contrary; manufacturing is often among the most vulnerable sectors when it comes to cybersecurity breaches.”

For industrial companies, weak cybersecurity endangers not just computer programs but also factory systems and power plants. Furthermore, the outdated infrastructure of many manufacturers makes them a target, and cyberattacks on operational technology might hinder production, order fulfillment and, ultimately, profitability.

Businesses should tailor their cybersecurity controls and protections based on the risks they face. A few areas for manufacturers to prioritize include identity access management, cloud security processes, zero-trust architecture and penetration testing.