Data, privacy and safety · Module 111
🏭 Cybersecurity for Manufacturing and Industrial Control Systems™
For plant managers, controls engineers, maintenance and IT staff, small manufacturers and their vendors, utility and pipeline operators, defense suppliers, and the reporters, advocates and officials who watch them: 7 long lessons on how factory and plant systems (OT) differ from office IT, the Purdue model, ISA/IEC 62443 and NIST SP 800-82, real attacks from Colonial Pipeline and NotPetya to the 2026 attacks on water systems, remote access and vendors, patching without stopping production, keeping safety and security together, the sector rules (NERC CIP, TSA pipeline directives, CMMC and NIST SP 800-171, FDA), and a plant-floor segmentation plan, with sample policies. Rules stated as of October 28, 2026.
Read this first
This module is general education about cybersecurity for factories, plants, utilities, pipelines and other industrial operations. It is not legal, compliance, audit, engineering, safety, insurance or professional advice, and reading it creates no consulting, engineering or audit relationship. Reading or using any part of it, including the sample policies and the segmentation plan, does not make an organization compliant with NERC CIP, a TSA security directive, CMMC, NIST SP 800-171, FDA rules, ISA/IEC 62443 or any other standard or rule. Rules, directives, deadlines and penalty amounts change: every lesson states the rule version and the date it was checked, and you should check the current text from the regulator (eCFR, the Federal Register, NERC, FERC, TSA, DoD, FDA, CISA) before relying on any point.
Safety first: never change a production, safety or control system because of a web lesson. Involve the equipment vendor, your safety lead and qualified controls and process safety engineers, and test changes in a planned outage or a test system first.
Defensive content only: nothing here explains how to attack a system. There is no exploit code and no attack steps.
The high level view
Who this affects. Factories, food processors, sawmills, chip makers, chemical and fuel plants, water and wastewater systems, power plants and substations, pipelines, and the defense and medical device suppliers that sell to the government and hospitals. These places run on operational technology (OT): controllers, sensors, operator screens and safety systems that move real equipment. When OT stops, production stops, and when it fails badly, people can be hurt. Manufacturing has been the most attacked industry in IBM's X-Force index for five years running, and Dragos counted about 3,300 industrial organizations hit by ransomware in 2025, most of them manufacturers. Idaho had about 77,500 manufacturing jobs in September 2026 (preliminary federal figures), and Idaho National Laboratory in Idaho Falls is one of the country's main centers for control system security.
The main rules and guides, as of October 28, 2026.
- No single federal cybersecurity law covers all manufacturers. The voluntary guides most plants use are NIST SP 800-82 Rev. 3 (September 2023; a Rev. 4 draft is open for comment until November 30, 2026), the ISA/IEC 62443 series of standards, NIST's Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals and OT guidance.
- Electric utilities follow the mandatory NERC CIP reliability standards, approved by the Federal Energy Regulatory Commission, with penalties of up to $1,584,648 per violation per day.
- Large pipelines follow TSA Security Directives Pipeline-2021-01G and Pipeline-2021-02G; a permanent TSA rule proposed in November 2024 is not final.
- Defense suppliers follow DFARS 252.204-7012 (72-hour incident reporting) and NIST SP 800-171 Rev. 2. The CMMC rule (32 CFR Part 170) took effect in contracts November 10, 2025, but the Defense Department suspended Phase 2 on July 13, 2026 for a review.
- Medical device makers follow section 524B of the Federal Food, Drug, and Cosmetic Act; public companies follow the SEC's cybersecurity disclosure rules; ports and plants with regulated docks follow the Coast Guard's 2025 rule; exporters to Europe face the EU Cyber Resilience Act.
The five things to do first. Plan each with the equipment vendor, your safety lead and qualified engineers, and test before changing anything on the plant floor.
- Make a list of what is on the plant floor and every way in and out of it, including vendor modems and remote access tools (lessons 1, 4 and 7).
- Take control systems off the open internet, change default passwords and put remote access behind multi-factor sign-in and a supervised jump host (lessons 3 and 4).
- Separate the office network from the plant network with a firewall and an industrial DMZ, so ransomware in email cannot reach the line (lessons 1 and 7).
- Keep offline backups of controller programs and practice running the plant by hand (lessons 5 and 7).
- Find out which rules apply to you, from NERC CIP to CMMC, and who you must notify after an incident and how fast (lesson 6).
- 1IT and OT: How Plants Differ, and the Purdue ModelWhat operational technology is, how a plant's control systems differ from office IT, and what each part of an industrial control system does, walked through on one example line. Where the Purdue model came from, what its levels and the industrial DMZ mean, how NIST SP 800-82 and ISA/IEC 62443 use or move beyond it, the OT threat picture in brief, and who is affected in Idaho.65 min
- 2The Standards: ISA/IEC 62443 and NIST SP 800-82ISA/IEC 62443 and NIST SP 800-82 are the two main standards for securing factory and plant control systems. This lesson explains 62443's parts, roles, zones and conduits, foundational requirements, security levels and certification; what NIST's OT guide, its overlay and its September 2026 draft revision cover; and how CISA's goals and 2025 to 2026 OT guides, the CSF Manufacturing Profile and MITRE ATT&CK for ICS fit together, ending with where a small manufacturer, including one in Idaho, should start.60 min
- 3ICS Threats and Real Cases: Colonial Pipeline, NotPetya and What Came AfterWho attacks factories, utilities, pipelines and water systems, and why, with the 2025 and 2026 data from Dragos, IBM, Verizon, the FBI and CISA. Then the record of the major cases, from Stuxnet and the Ukraine grid attacks through Triton, NotPetya, Norsk Hydro, Colonial Pipeline, Aliquippa, Volt Typhoon, Clorox and Jaguar Land Rover to the 2026 attacks on PLCs and water systems, told from testimony, filings, indictments and advisories, with what defenders learned.60 min
- 4Remote Access, Vendors and the Supply ChainRemote access is how most attackers reach a plant, from Colonial Pipeline's old password-only VPN account to the internet-exposed PLCs disrupted in 2023 and 2026. This lesson shows how to find every remote path, the secure remote access practices NIST, CISA and the 2026 connectivity principles agree on, what NERC and TSA already require, and how to handle vendors, integrators, SBOMs and software integrity, with a sample OT remote access policy and sample vendor contract requirements.60 min
- 5Patching Without Stopping Production, and Keeping Safety and Security TogetherWhy plant-floor patching is hard, what NIST SP 800-82 Rev. 3 asks for, how to rank vulnerabilities with CISA KEV and SSVC, and how to protect what cannot be patched with compensating controls, backups, golden images and management of change. The second half explains process safety, safety instrumented systems, OSHA PSM hazard analysis, cyber PHA, and Idaho National Laboratory's Cyber-Informed Engineering methods, with Triton as the warning and manual operation as the fallback.70 min
- 6Sector Rules: NERC CIP, TSA Pipeline Directives, CMMC, FDA and MoreThere is no single federal cybersecurity law for manufacturers: which rules reach a plant depends on what it makes, who it sells to, what it owns and whether it is publicly traded. This lesson explains each rule that can reach an industrial operator, from NERC CIP, the TSA pipeline directives and DFARS, NIST SP 800-171 and CMMC (including the July 13, 2026 suspension of Phase 2) to FDA section 524B, water, chemical and maritime rules, CIRCIA, the SEC, EU product rules and Idaho law, with each rule's version, date and status as of October 28, 2026.70 min
- 7A Plant-Floor Segmentation Plan, Step by StepA worked example that takes one invented 120-person southern Idaho metal-parts plant from a flat network to zones, conduits and an industrial DMZ, in eight steps that follow NIST SP 800-82 Rev. 3, ISA/IEC 62443-3-2 and CISA's 2025 and 2026 OT guidance. It includes a before and after network drawing, a zones-and-conduits table, a phased 90-day, 6-month and 12-month timeline, costs and free help for small manufacturers, and a sample segmentation standard and worksheet.75 min
Related courses (linked, not repeated)
- Home Computer Security: the plain-language base: updates, passwords and two-step sign-in, scams, backups.
- Small Business Data Security: the plain-language base for a small office: accounts, backups, email, Wi-Fi, scams aimed at businesses and a 90-day plan.
- Privacy and Security for Small and Medium Businesses: the management program: risk assessment, NIST CSF and CIS, CMMC basics, vendors, people, incident response, continuity and cyber insurance, identity, patching and board reporting.
- Privacy and Data Security Laws: the federal and state privacy and breach laws, including Idaho's breach notice law.
- Healthcare Cybersecurity and HIPAA, lesson 7: Medical Devices and Clinical Technology: device cybersecurity from the hospital side.
- Cybersecurity for Legal, Accounting and Professional Services, lesson 6: business email compromise and payment fraud, which hit manufacturers' accounts payable too.
- How the Power Grid Works: who runs and regulates the grid that NERC CIP protects.
- Data Centers, lesson 9: Security and Reliability: physical and cyber security at data centers, which share building control systems with factories.
- Natural Gas, lesson 2: Moving Gas: the pipeline system the TSA directives cover.
How this module was made
Every lesson was written from primary sources: NIST, CISA, DOE and Idaho National Laboratory publications, the Code of Federal Regulations and the Federal Register, NERC and FERC records, TSA security directives, DoD and FDA rules, court records, Justice Department releases and company SEC filings, cited in numbered notes. ISA/IEC standards are paid documents; they are described, not reproduced. Each lesson was then checked by an independent checker who did not write it, against the primary text, with the regulatory citations checked a second time. Points that could not be confirmed are listed at the end of each lesson under "Still being checked". Government documents used are public domain; photographs are public domain or freely licensed, with the license in each caption. The Purdue model diagram and all infographics are original drawings.