In this guide · 8 sections
- 01Why OT cybersecurity matters for small manufacturers
- 02Step 1: separate the machine network from office IT
- 03Step 2: control vendor remote access
- 04Step 3: old Windows on line PCs
- 05Step 4: back up machine configurations and programs
- 06Step 5: plan for an incident on the shop floor
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Start with four things: separate the machine network from office IT with a firewall, control and log vendor remote access, protect or isolate old line PCs that can't be patched, and back up PLC programs and machine settings offline. Then plan how to restart production after an incident.
Why OT cybersecurity matters for small manufacturers
OT is the hardware and software that controls physical processes: programmable logic controllers (PLCs), operator panels (HMIs), SCADA software, line PCs, robot controllers, and building systems such as air-conditioning and access control. In a large plant these have their own team. In an SME, they usually belong to production, a machine vendor and whoever looks after the office IT, which is how gaps appear.
The risk is mostly not targeted sabotage. It is ordinary ransomware or malware spreading from the office into a line PC that runs a machine, or a vendor's always-on remote access tool being abused. The result is the same: production stops. Our guide on what to do in a ransomware attack covers the first hours; this guide is about stopping it reaching the machines.
CSA launched its OT Cybersecurity Masterplan 2024 on 20 August 2024. One of its four thrusts is to uplift OT cybersecurity resilience beyond critical information infrastructure, and the Masterplan was co-created with groups that included OT SMEs.
Step 1: separate the machine network from office IT
This is the single most valuable step. NIST's Guide to OT Security, SP 800-82r3 (September 2023) recommends logical separation between corporate and OT networks with stateful firewalls or unidirectional gateways, a DMZ so traffic does not pass directly between the two, and separate accounts for OT and corporate users.
| Setup | What it looks like | Risk |
|---|---|---|
| Flat network | Office PCs, Wi-Fi and machines on one network | High: anything on the office side can reach machines |
| VLANs, no firewall rules | Separate VLANs but routing allows everything | Still high: separation in name only |
| Firewall between IT and OT | Only named traffic allowed, such as MES data to one server | Much lower |
| Firewall plus DMZ | Shared servers sit in a middle zone; no direct IT-to-OT traffic | Lowest practical for an SME |
In practice for a small plant: put machines and line PCs on their own network segment behind a firewall, allow only the specific connections production really needs, and give the machine network no direct internet access. Keep a simple diagram of what connects to what.
Step 2: control vendor remote access
Machine suppliers often need remote access for support, and many install a remote desktop tool that stays on permanently with a shared password. That is one of the most common ways into OT networks.
List every remote access path
Remote desktop tools, VPNs, 4G routers inside machine cabinets, and cloud portals supplied with equipment. Ask each vendor what they installed.
Remove always-on access
Switch to access on request: the vendor asks, someone in the plant enables it for that session, and it is turned off afterwards.
Require MFA and named accounts
Each vendor engineer has their own login with multi-factor authentication. NIST lists MFA for remote access to OT as a core practice.
Route access through one controlled point
A single remote access gateway or jump host in the DMZ, rather than tools installed directly on line PCs.
Log sessions
Keep a record of who connected, when and what they changed, and review it after each session.
Step 3: old Windows on line PCs
Machines often come with a PC running a specific Windows version that the vendor has certified, and upgrading can void support or break the software. Check which edition you actually have:
- Windows 10 Home and Pro reached end of support on 14 October 2025, per Microsoft's lifecycle page. Without paid Extended Security Updates they get no more security fixes.
- Windows 10 IoT Enterprise LTSC 2021, common on embedded and machine PCs, has extended support until 14 January 2032, per its lifecycle page.
- Older versions such as Windows 7 have no support at all and should be treated as untrusted.
When a line PC cannot be updated, protect it from around it: isolate it on the machine network, block internet access, disable USB ports or use only scanned, dedicated USB drives, remove email and web browsing from it, and ask the vendor about application allow-listing. Ask vendors for their supported upgrade path at the next maintenance contract renewal.
Step 4: back up machine configurations and programs
If a line PC is encrypted by ransomware or a PLC loses its program, the fastest recovery is a known-good copy. Many SMEs discover too late that the only copy sat with a vendor engineer who has left.
Machine backup checklist
Keep office backups separate as well. Our guide to backing up Microsoft 365 and Google Workspace covers the office side; the principle of an offline copy that ransomware cannot reach applies to both.
Step 5: plan for an incident on the shop floor
Write a short plan that production and IT both understand. It should say who can decide to disconnect the machine network from office IT, how to keep running (or safely stop) if the line PCs are down, which vendor to call for each machine, and where the backups are. Safety comes first: decisions about stopping equipment belong to the people responsible for the process, not IT alone.
Office IT incident
- Isolate affected laptops
- Restore email and files from backup
- Production can often continue if networks are separated
Best for: Phishing, account takeover, office ransomware.
OT incident
- Safety check before any shutdown
- Disconnect OT from IT and the internet
- Machine vendors needed for restore
- Restart from known-good configurations
Best for: Malware on line PCs, unexplained machine behaviour.
For the office side, CSA's Cyber Essentials mark covers the basics that stop most attacks reaching the plant in the first place; see our Cyber Essentials checklist.
Do it yourself or get help?
Inventories, vendor access lists and machine backups are work your production and maintenance team can start this month. Network separation needs someone who understands both firewalls and your machines, plus the machine vendors at the table.
Our Security Health Check (S$290) reviews the office side, which is where most attacks start. Backup & Ransomware Recovery (S$290) sets up Microsoft 365 or Google Workspace and website backups with a test restore and a one-page recovery guide. The Incident & Ransomware Response Plan (S$390) writes the plan your team follows, with contacts and decision points. For OT network redesign itself, involve an OT-specialist integrator and your machine vendors.
Frequently asked questions
Operational technology cybersecurity protects the systems that control physical processes, such as PLCs, operator panels, SCADA software, line PCs and building controls. Unlike office IT, the priority is safe and continuous operation, so changes need testing and coordination with production and machine vendors before they are made.
Targeted attacks on small plants are rare, but ordinary ransomware does not care whether a PC runs a machine. If the office and machine networks are connected, malware from a phishing email can reach line PCs and stop production. Separating the networks removes most of that risk.
It depends on the edition. Windows 10 Home and Pro lost support on 14 October 2025, while Windows 10 IoT Enterprise LTSC 2021 is supported until January 2032. Unsupported PCs that must stay should be isolated from the internet and office network, with USB and email use locked down.
CSA's OT Cybersecurity Masterplan 2024 sets national direction and aims to raise OT security beyond critical infrastructure, but there is no specific mandatory OT standard for ordinary SMEs. Many use NIST SP 800-82r3 as a practical reference and CSA's Cyber Essentials mark for the office side.
On request rather than always on, through one controlled gateway, with a named account and multi-factor authentication for each engineer, and with sessions logged. Avoid remote desktop tools installed directly on line PCs with shared passwords, and turn access off when the job is done.