Cyber Essentials for manufacturing
Who asks manufacturing for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Common fails
- A6.7A7.2A6.4AUTO-FAIL
- Typical scope
- Operational technology, Shop-floor shared PCs, Vendor remote access, ERP on old servers
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
Manufacturers usually meet Cyber Essentials as a contract requirement from defence, public sector or large commercial customers rather than from a regulator. The recurring difficulty is operational technology: machine controllers on unsupported Windows must be segregated into a sub-set with no internet access or they fail the unsupported-software rule.
Do manufacturers need Cyber Essentials?
Not formally. No manufacturing regulator mandates the certificate. Defence contracts carrying DEFCON 658 and customer supply-chain terms drive demand.
Ministry of Defence
Source checkedContracts carrying DEFCON 658 apply Def Stan 05-138 Issue 4, which requires Cyber Essentials at every cyber risk profile level and Plus at Levels 2 and 3. Primes must flow the requirement down: each subcontract gets its own risk assessment and the subcontractor completes a Supplier Assurance Questionnaire (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do manufacturers need Cyber Essentials or Cyber Essentials Plus?
On defence work the cyber risk profile level decides it: Cyber Essentials at Levels 0 and 1, Plus as well at Levels 2 and 3. Commercial customers name the level in their supplier terms.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should manufacturers gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- A network diagram showing the office network, the shop-floor or OT network, and the firewall or VLAN between them (A2.2.1, A2.2.2).
- A list of machine controllers, PLC programming laptops and HMI panels with their operating systems, marking which are unsupported (A6.1, A6.7).
- Every machine vendor with remote access, the tool they use and how access is switched on and off (A7.2, A7.3).
- The ERP and MES versions and the server operating systems they run on (A2.7, A6.1).
- Firewall and router firmware versions and the date each was last updated (A6.4).
What scope problems do manufacturers bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Operational technology
CNC controllers, PLC programming laptops and SCADA HMIs on old Windows versions must sit in a sub-set with no internet access. A sub-set that keeps internet access forces a partial-organisation certificate.
Shop-floor shared PCs
Terminals with a shared login for clocking or job tracking fail unique credentials, unless the terminal has no access to organisational data or services.
Vendor remote access
Machine vendors with standing VPN or remote-control access need named accounts, MFA, and removal when not in use.
Which questions do manufacturers commonly fail?
Questions manufacturers commonly fail include A6.7, A7.2 and A6.4AUTO-FAIL. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A6.7Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this. | Unsupported machine controllers on the same flat network as the office are a common issue in manufacturing assessments. | Put OT on its own VLAN with no route to the internet, describe the segregation in A2.2.2 and list the firewall or switch that creates it in A2.5.1. |
| A7.2Are all your user and administrative accounts accessed by entering unique credentials? | Shared shop-floor accounts are widespread. | Issue named accounts, or remove the terminal's access to organisational data and services and document that. |
| A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | Firewall firmware updated only at annual maintenance visits misses the 14-day rule. | Subscribe to the vendor's security advisories, install critical and high-risk firmware fixes within 14 days, and record the dates. |
Frequently asked questions
Yes. Under section D of the v3.3 requirements, every account your organisation owns is in scope even when a supplier uses it to support your equipment. Give each vendor a named account, put MFA in front of it, and disable it between support sessions so you can answer A7.3 and A7.16 truthfully.
Yes as a sub-set, if it is segregated by a firewall or VLAN and you describe how in A2.2.1 and A2.2.2. Security groups and software-based segmentation do not count. If the sub-set contains unsupported software it must have no internet access; if it keeps internet access, the certificate becomes partial organisation.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Fortinet FortiGate setupFirewall control settings and segregation
- Sophos Firewall setupAdmin access and inbound rules
- Windows Server support statusSupport dates for ERP and file servers
- Scope and sub-setsHow to segregate unsupported equipment
- Cyber Essentials for MoD suppliers: DEFCON 658The deep page on this mandate.
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for MSPs and IT providers
- Cyber Essentials for recruitment
- Cyber Essentials for housing associations
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh