A plain-language, 30-question checklist that shows small and mid-sized manufacturers where they stand on cyber resilience in about 20 to 30 minutes. It covers both your office systems and your plant floor: the machines, controls, and networks that keep production running. There are no trick questions and no wrong answers; the goal is an honest picture of where you stand today.
How to Answer
Answer each question with one of four choices: Yes, Partly, No, or Not sure. If you don't know, choose Not sure. That is useful information on its own, because a blind spot is a risk.
Questions marked with a star are priority questions. They are the most common causes of production-stopping attacks. A No or Not sure on any of them is a priority, whatever your total score.
If you would rather work through the checklist on paper or in Word, the complete version with answer boxes, space for notes, and the scoring sheet is available to download at the end of this page.
About Your Operation
Why it matters: this helps us tailor our recommendations to how your plant actually runs. These answers are not scored.
- Company name and location(s)
- Number of employees and number of sites
- What you make, and how many production lines you run
- Who handles IT today: in-house staff, an outside IT company, the owner or manager, or no one
- Who maintains machine controls such as PLCs and HMIs: your own maintenance team, a system integrator, or the machine vendor(s)
- If an attack stopped production tomorrow, who decides what to do (name and role)
- Whether you have cyber insurance and, if so, which month it renews
- Whether a customer or insurer has asked you security questions in the last year
- Any cyber incident, ransomware, or suspicious event in the last 3 years
Section 1 - Know What You Have and What Matters
Why it matters: you can't protect machines you don't know are on the network, and you can't plan a recovery if you don't know which systems stop the line.
- 1.1 Do you have an up-to-date list of all computers, servers, and network equipment, in the office and on the plant floor?
- 1.2 Does that list include your production controls: PLCs, HMIs (operator touch screens), SCADA, and the laptops used to program machines?
- 1.3 Do you know which systems would stop production if they went down? Think ERP, scheduling or MES, the PC that runs a line, label printers, and file shares
- 1.4 Have you decided how long you can afford to be down, and do you know how long it would actually take to get back up?
- 1.5 Is one named person responsible for cybersecurity, including the plant floor, not just office IT?
Section 2 - Office Vs Plant Network Separation
Why it matters: most attacks on manufacturers start in the office (a phishing email) and spread to the plant because the two networks are connected. Separation is what keeps an office infection from stopping production.
- Priority question: 2.1 Is your plant floor network separated from your office network, so an infected office PC can't reach machines directly?
- 2.2 Is traffic between the office and the plant controlled by a firewall that only allows specific, approved connections?
- 2.3 Are production lines separated from each other, so a problem on one line can't spread to all of them?
- Priority question: 2.4 Are your machines, controllers, and plant PCs unreachable directly from the internet? Not sure? We can check this from the outside for you, safely and at no cost
- 2.5 Do old plant computers (for example, Windows XP or 7 running a machine) have extra protection: isolated, with no email or web browsing?
Section 3 - Remote Access and Logins
Why it matters: vendor remote access and stolen passwords are the most common way attackers get into plant systems. A single always-on vendor connection can bypass every other control.
- 3.1 Do you know every vendor, integrator, and employee who can connect remotely to plant systems? Include tools like TeamViewer, AnyDesk, or a VPN a machine builder set up years ago
- Priority question: 3.2 Is vendor remote access turned off by default, and only turned on when needed for a specific job?
- Priority question: 3.3 Does remote access and email require a second login step, such as a code or app on a phone (multi-factor authentication)?
- 3.4 Does everyone have their own login, with no shared accounts like "operator" or "admin" used by several people?
- 3.5 Have default factory passwords been changed on machines, controllers, routers, switches, and cameras?
Section 4 - Detecting and Responding to an Attack
Why it matters: ransomware usually runs at night or on weekends. The difference between a bad day and a two-week shutdown is how fast someone notices and whether people know what to do.
- 4.1 Do office computers and servers have modern endpoint protection (EDR, not just basic antivirus) that someone actively watches?
- 4.2 If something suspicious happened at 2 a.m. on a Saturday, would someone notice and respond before Monday morning?
- 4.3 Would you notice something unusual on the plant network, like an unknown device talking to a PLC?
- 4.4 Do you have a written plan for a cyber attack: who to call, what to disconnect, and what must NOT be shut down for safety reasons?
- 4.5 Have you walked through that plan with your team (even a 1-hour tabletop discussion) in the last 12 months?
Section 5 - Backups, Recovery, and Updates
Why it matters: backups are your last line of defense against ransomware, but only if the attacker can't reach them and you've proven you can restore. Plant-floor backups (PLC programs, HMI settings) are the ones most often missing.
- 5.1 Do you back up PLC programs, HMI configurations, and machine settings, not just office files?
- Priority question: 5.2 Is at least one backup copy offline or unchangeable, so ransomware can't encrypt or delete it?
- 5.3 Have you restored a critical system from backup in the last 12 months to prove it works?
- 5.4 Could the plant keep running in a manual mode, or shut down safely, if computers were unavailable, with written steps?
- 5.5 Are office systems updated regularly (at least monthly), and are plant-floor updates tested before going on live machines?
Section 6 - People, Physical Security, and Vendors
Why it matters: an infected USB drive, an unlocked cabinet, or a compromised IT provider can undo every technical control. These are cheap to fix and often overlooked.
- 6.1 Do all employees, including plant floor staff, get security awareness training at least once a year? Phishing emails, unknown USB drives, and reporting strange machine or screen behavior
- 6.2 Are USB drives and contractor laptops checked or controlled before they connect to plant equipment?
- 6.3 Are control cabinets, network closets, and server rooms kept locked?
- 6.4 Do you ask key vendors (IT provider, integrators, machine builders) about their security before giving them access?
- 6.5 Do you have a backup plan if a critical supplier or your IT provider is hit by ransomware?
Your Score
Count your answers in each section: Yes is 2 points, Partly is 1 point, and No or Not sure is 0 points. Each section has a maximum of 10 points, for a total of 60. Then count how many of the five starred priority questions you answered No or Not sure; each of those is a priority fix regardless of your total.
- 0 to 20, High risk: a single phishing email or vendor connection could likely stop production. Act now
- 21 to 38, Significant gaps: some basics are in place, but key weaknesses need a plan in the next 90 days
- 39 to 50, Good foundation: solid basics with specific gaps to close
- 51 to 60, Strong: keep testing and improving, and review again every 6 to 12 months
What Happens Next
Send your completed checklist back to us, or we can go through it together on a 30-minute call. Within one week, Cyber Pillar will give you a short written summary with:
- Your top 3 risks, explained in plain language
- Practical fixes, starting with low-cost and no-cost steps
- An outside check of whether any of your systems are visible from the internet
The review is free, and there is no obligation.