A cyber insurance proposal can expose weaknesses that have sat quietly in a manufacturing business for years. The essential cyber insurance controls insurers ask about are not just paperwork. They are the measures most likely to prevent ransomware, fraud or a compromised account from stopping production, delaying deliveries or exposing valuable designs.
For a manufacturer, the priority is clear: prove that a cyber incident is less likely to spread, and that the business can recover if one does occur. Insurers will vary in what they require, and policy wording matters, but several controls now appear consistently in applications and renewal questions.
What are essential cyber insurance controls?
Essential cyber insurance controls are the technical and management measures an insurer expects a business to have in place before offering cover, setting terms or agreeing to pay a claim. They commonly cover identity security, software updates, backups, email protection, endpoint security and incident response.
The questions can look straightforward. “Do you use multi-factor authentication?” is a familiar example. The difficulty is whether the answer applies everywhere it needs to. If multi-factor authentication protects Microsoft 365 but not remote access to an ERP server, a business may have a gap that matters both operationally and to its insurer.
Insurance is not a substitute for security. It helps manage the financial consequences of an incident, subject to the policy terms. Good controls reduce the chance that you need to make a claim at all, which is rather preferable to learning how an incident response line works at 2am.
The controls that deserve immediate attention
Multi-factor authentication for every remote doorway
Multi-factor authentication, often shortened to MFA, requires more than a password to sign in. It might use an authenticator app, security key or approved prompt on a mobile phone. It is one of the most common insurance expectations because stolen passwords remain a reliable route into business systems.
Apply MFA to Microsoft 365, cloud applications, remote desktop access, virtual private networks, remote support tools and administrator accounts. Do not overlook email accounts used by directors, finance teams or purchasing staff. These are frequent targets for invoice fraud and account takeover.
The practical issue in manufacturing is shared access. A shared shop-floor PC should not mean a shared privileged account. Where several people use one machine, give each person an individual account where possible, remove unnecessary administrator rights and use a controlled process for access to specialist software.
Patching that reflects production reality
Insurers will usually ask whether operating systems, applications and network devices are supported and kept up to date. That is sensible, but the answer is not simply “install every update immediately”. An untested update applied during a production run can cause a different kind of disruption.
Use a managed patching process. Critical security updates for standard office and server systems should be assessed and deployed promptly. Test updates first where a system supports ERP, MRP, CAD, CAM, machine programming or quality control. Schedule maintenance windows with operations, record exceptions and review them regularly.
Legacy machinery-connected computers need particular care. If an old Windows device is required to run a machine and cannot be upgraded without supplier approval, do not pretend it is normal office equipment. Isolate it on a separate network segment, prevent internet access unless there is a defined need, tightly restrict who can reach it and keep a documented recovery plan. Segregation reduces risk, but it does not make unsupported software safe or automatically satisfy an insurer.
Backups that restore critical operations
A backup is useful only if it can be restored within a timeframe the business can live with. For a manufacturer, that may mean restoring an ERP database, production scheduling data, engineering drawings, file shares and key configuration files for machinery or warehouse systems.
Keep backups separate from the main network so a ransomware attacker cannot simply encrypt both the live data and the backup copies. Use protected or immutable backup storage where appropriate, restrict backup administration accounts and monitor whether jobs complete successfully.
Most importantly, test restoration. Test a representative file, a server or application recovery, and the process for rebuilding a replacement device. A recovery test often uncovers missing passwords, undocumented dependencies or a backup that completed without capturing the data anyone actually needs. Agree recovery priorities with production and finance before an incident, not while orders are stacking up.
Protected email and payment processes
Email remains a common entry point for malware and fraud. Filtering, attachment scanning and phishing protection should sit alongside staff awareness. The aim is not to turn everyone into a security specialist. It is to make suspicious messages easier to spot and simpler to report.
Finance controls are equally important. A convincing email from a supplier asking to change bank details can bypass technical security if the process allows it. Require independent verification using a known contact number before changing payment details or approving unusual payment instructions. The same principle applies to last-minute requests that appear to come from a director.
Managed devices and endpoint protection
Every laptop, desktop and server that can access business data needs visibility. Modern endpoint protection can detect suspicious behaviour such as ransomware activity, unauthorised tools or attempts to disable security software. It is stronger when paired with active monitoring and a clear response process.
This is harder in mixed environments. A design engineer’s laptop, a warehouse handheld device and a PC attached to an older machine do not carry the same risk or tolerate the same controls. Classify devices, establish an owner and apply the strongest practical protection to each group. Unknown devices connecting to the network should be treated as a problem to resolve, not an interesting surprise.
Network segregation protects the factory floor
A flat network allows a problem on one computer to reach far more systems than it should. In a factory, that can mean an infected office device reaching file servers, ERP services or machinery-connected equipment.
Separate office IT, production equipment, guest Wi-Fi, warehouse devices and server infrastructure into appropriate network segments. Control the traffic permitted between them. For example, a machine PC may need to communicate with a specific engineering server, but it does not need unrestricted access to every office computer.
Segregation needs careful design. Some older applications rely on broad network access, and some equipment suppliers need connectivity for support. Map those requirements first. Then allow only the connections that are needed, document them and review remote access arrangements. An always-on supplier connection with a shared password is convenient right up to the point it is not.
Remote access needs named users and clear limits
Remote access is often necessary for machine suppliers, software providers and internal support teams. It can also be a significant route into the business if it is unmanaged.
Use named accounts, MFA and time-limited access where possible. Record who approved access, why it was needed and when it should end. Give suppliers access only to the systems they need, rather than the wider network. If a supplier insists on an insecure method, involve operational and commercial decision-makers early. The trade-off may be between a short-term support convenience and a long-term exposure that affects production and insurance terms.
Documentation matters because responsibility matters
Insurers may ask about incident response plans, security policies, staff training and asset records. These should not be produced purely to satisfy a questionnaire. They help the business act quickly when something goes wrong.
Your incident plan should identify who can make operational decisions, who contacts the insurer and relevant suppliers, how you isolate affected systems and how you communicate with staff and customers. Keep a current list of critical systems, their owners, dependencies and recovery priorities. A plan that assumes every application can be switched off immediately is unlikely to survive its first encounter with a live production schedule.
Review the insurance application with the people who understand the systems, not just the person completing the form. An inaccurate “yes” can create problems later. Where a control is incomplete, document the gap, the risk and the planned improvement. Your broker and insurer can clarify how that affects cover, while your IT team can focus on closing the underlying issue.
A practical way to prioritise improvements
Start with the systems whose failure would stop production, prevent dispatch, block invoicing or expose intellectual property. Check how users access them, whether they are supported, how they are backed up and what would happen if their network connection was lost.
Then focus on the controls that reduce common routes of attack: MFA, patching, endpoint protection, protected backups and secure remote access. Network segregation and a tested recovery plan are particularly valuable where office systems and factory-floor technology have grown together over time.
For manufacturing businesses in Hampshire, Surrey and West Sussex, a useful next step is a focused review of your insurance questionnaire alongside your actual systems. Syn-Star can help identify where the answers, the evidence and the operational reality do not yet match, then build a practical plan that protects production without creating unnecessary disruption.
