A ransomware attack does not stop neatly at the office. It can lock an ERP system, prevent warehouse staff from despatching goods, cut access to CAD files and leave production planners working from incomplete information. Cyber insurance can help manage the financial consequences, but it is not a substitute for keeping the business running.
For manufacturers and engineering firms, the right policy is one that reflects how work actually happens. That means understanding dependencies between office systems, factory-floor devices, machinery-connected PCs, remote suppliers and critical applications. It also means meeting the insurer’s security conditions before an incident, not discovering them while production is already delayed.
What cyber insurance should cover
Cyber insurance is designed to help a business respond to specified cyber incidents, such as ransomware, data theft, fraudulent payments or disruption caused by a network attack. Policies differ considerably, so the detail matters more than the headline limit.
A useful policy may contribute towards incident response specialists, legal and forensic support, customer notification where required, data recovery, crisis communications and certain financial losses. Some policies also provide cover for business interruption. This is particularly relevant where an attack stops order processing, planning, despatch or another system needed to maintain output.
However, business interruption cover needs close attention. Ask how the policy defines an interruption, how long the waiting period is, what evidence of lost income or additional costs will be required, and whether dependent suppliers are included. A factory that cannot receive electronic job sheets may be disrupted even if its machinery is technically still able to run.
Do not assume a policy covers every technology failure. General hardware breakdown, poor maintenance, a power outage, gradual loss of data or a pre-existing weakness may fall outside its scope. Cover for operational technology and machinery-connected equipment can also be narrower or subject to particular conditions.
Why manufacturing cyber insurance needs a different conversation
A standard office-based risk assessment can miss the systems that matter most on a manufacturing site. A shared PC on the shop floor may run an old application needed to programme a machine. An unsupported operating system may be isolated from the internet, but still depend on a file share used by production. Remote access for a machine supplier may be necessary for support, yet create a route into the wider network if it is not controlled.
These are not theoretical edge cases. They are normal operational constraints. Replacing an ageing industrial computer may require a planned shutdown, application testing and supplier involvement. Until then, the sensible approach is to reduce exposure through network segregation, tightly controlled access and tested recovery arrangements.
Insurers will usually look at the overall security posture, rather than judging one old device in isolation. The issue is whether you understand the risk and have taken proportionate action. An unmanaged, internet-connected Windows device with shared passwords is difficult to defend. A legacy machine placed on a separate network, with restricted access, documented ownership and a recovery plan is a far more credible position.
The controls insurers commonly expect
Insurers’ application questions and policy conditions change over time, so always check the wording for the policy you are considering. That said, several controls repeatedly matter because they reduce the likelihood and impact of common attacks.
Multi-factor authentication should protect remote access, email and cloud administration accounts. A password alone is easily stolen, guessed or reused. Multi-factor authentication adds a second check, usually through an authenticator app or security key.
Patching is equally important, but it must be managed around production. Office PCs and servers may follow a regular patching schedule. Machinery-connected systems often need supplier approval, testing or a defined maintenance window. The answer is not to ignore them. Keep an accurate record of what cannot be patched, why, and what compensating controls are in place.
Backups need more than a green tick on a dashboard. You need separate, protected copies of critical data and evidence that they can be restored. Test the recovery of ERP or MRP data, CAD files, configuration settings and the systems that support despatch. A backup that takes three days to restore may be technically valid but operationally inadequate.
Other areas that frequently feature in insurer questions include endpoint protection, secure email, privileged access, incident response plans and staff awareness. Keep the evidence. Insurers may ask for confirmation during the application process, and the business may need to demonstrate that stated controls were operating when an incident occurred.
Be accurate when completing the proposal
The proposal form is not a formality to hand to someone who has only a partial view of IT. Inaccurate answers can create disputes at the point when you most need help. Involve the person responsible for IT, an internal IT manager or your managed IT provider, alongside finance and operations.
Pay particular attention to questions about multi-factor authentication, backups, remote access, software support and previous incidents. “Yes” may mean every relevant user and system, not simply that the feature exists somewhere in the business. If remote desktop access is exposed to the internet, or supplier accounts are shared, say so and address it rather than hoping the question does not arise again.
It is also worth mapping which systems support revenue. For example, a manufacturer may rely on Microsoft 365 for orders and communication, an ERP system for planning and traceability, a warehouse system for goods movements, and a CAD platform for design changes. This helps a broker arrange appropriate cover and gives the business a clearer recovery priority.
Avoid treating compliance as a policy add-on
Cyber Essentials can support a stronger security baseline and may help satisfy customer or insurer expectations. It is not, by itself, a guarantee that a policy will pay a claim. Equally, buying cyber insurance does not make a business compliant with a customer’s security questionnaire or contractual requirements.
Treat these as connected but separate responsibilities. Cyber Essentials focuses on a defined set of technical controls. Insurance transfers some financial risk, subject to policy terms. Your wider security programme should protect the availability of production, the confidentiality of designs and commercial information, and the integrity of systems such as quality records and job data.
The best result is usually a joined-up approach: security controls are implemented and evidenced, risks around legacy equipment are documented, recovery plans are tested, and the insurance policy is reviewed against the systems that matter to the business.
Questions to ask before renewing or buying cover
Before selecting a policy, make sure the discussion goes beyond the policy limit. Ask whether ransomware negotiation and recovery support are included, whether business interruption reflects a production stoppage, and whether the policy applies to attacks involving a managed service provider or software supplier.
You should also ask about exclusions for unsupported software, unencrypted devices, fraud and supplier outages. Clarify who can appoint incident response specialists. Some insurers require you to use their approved legal, forensic or recovery partners, which can be helpful in a crisis but should be understood in advance.
Finally, consider the practical response. Who has authority to report an incident? Where are insurer contact details stored if email is unavailable? Who contacts the ERP provider, machine supplier and key customers? A short, rehearsed plan is more valuable than a lengthy document nobody can find at 2am.
Turn insurance requirements into better operational resilience
A good cyber insurance review often exposes useful gaps: unclear ownership of supplier access, untested backups, unsupported shop-floor devices or no agreed recovery order for critical systems. These are operational issues first and insurance issues second.
For manufacturing businesses in Hampshire, Surrey and West Sussex, a focused IT and cybersecurity assessment can establish what is connected, where production dependencies sit and which controls need attention before the next renewal. Syn-Star can help turn that review into a practical improvement plan that protects uptime as well as insurability.
