A ransomware incident does not have to reach the production line to stop production. If planners cannot access the ERP system, engineers lose access to drawings, or a shared shop-floor terminal is encrypted, orders, traceability and dispatch can quickly be affected. That is why an ISO 27001 manufacturing guide must go beyond office IT controls. It needs to account for the systems, people and suppliers that keep output moving.
ISO 27001 provides a structured way to manage information security risk. For manufacturers, the value is not a certificate on the wall. It is clearer control over the technology dependencies that can create costly downtime, expose commercially sensitive data or leave ageing operational equipment vulnerable.
What ISO 27001 means on a manufacturing site
ISO 27001 is the international standard for an information security management system, commonly called an ISMS. It asks a business to identify its information-security risks, select appropriate controls, assign ownership and continually check whether those controls are working.
The standard is deliberately flexible. A precision engineering business with a small office and several CNC machines will have a different scope from a multi-site manufacturer running cloud ERP, warehouse scanners, remote maintenance access and a 24-hour production schedule. The aim is not to apply every possible security measure. It is to make informed, documented decisions about the risks that matter to your operation.
For a manufacturer, that normally includes more than laptops and email. Your scope may need to cover ERP and MRP platforms, product designs, quality records, production scheduling, warehouse devices, factory Wi-Fi, file servers, remote access, backups and third-party support connections. Where operational technology is connected to the business network, it deserves particular attention.
Certification is optional for some businesses, while others face it as a customer, tender or supply-chain requirement. Either way, working to the standard can improve resilience. The strongest projects treat certification as evidence of good operational control, not the whole purpose of the exercise.
Start with production-critical risks, not a policy pack
A common mistake is beginning with generic templates and trying to make the business fit them. Start instead by mapping how information and systems support a live order – from enquiry and quotation through planning, manufacture, inspection, dispatch and invoicing.
Ask practical questions. Which systems would halt production within an hour? Who has administrator access to them? What happens if the ERP supplier cannot connect remotely? Can a machine run safely if its connected PC is unavailable? Are recovery instructions tested, or do they exist only as a backup job report?
This exercise often reveals risks that are easy to overlook. A shared terminal may use a common password. Engineering drawings may be copied to unmanaged USB drives. A production controller may rely on an unsupported operating system because replacing it would require machine revalidation. None of these automatically prevents ISO 27001 certification. What matters is that the risk is understood, owned and reduced as far as reasonably possible.
Your risk assessment should consider confidentiality, integrity and availability. Manufacturers often focus first on availability because lost output is immediately visible. However, altered machine settings, leaked designs, incorrect batch data or unauthorised changes to bills of materials can be just as damaging. A good assessment reflects the real consequence for safety, quality, contractual commitments and continuity.
Build an ISMS that people can actually run
An ISMS is not simply a folder of policies. It is the operating framework that turns security decisions into repeatable business practice. Senior management needs to define the scope, approve the security objectives and make sure responsibilities are clear. Without this involvement, controls tend to fade when production pressures rise.
Document the essential processes in language that suits the people using them. That typically includes access control, password and privileged-account management, incident response, backup and recovery, supplier management, change control, asset management and staff awareness. The documents should be proportionate. A small manufacturer does not need an enterprise-sized bureaucracy, but it does need evidence that the agreed process is followed.
Asset management is especially important in industrial environments. Keep an accurate record of servers, PCs, switches, wireless access points, mobile devices, production terminals and software. Record who owns each asset, where it sits, what it supports and whether it is supported by the vendor. When a fault or vulnerability appears, this information saves valuable time.
Treat legacy equipment as a managed risk
Older operating systems and specialist control PCs are a normal reality in manufacturing. Replacing them immediately may be impractical, expensive or disruptive to validated machinery. ISO 27001 does not demand an unrealistic rip-and-replace programme.
It does require a defensible plan. Segregate legacy equipment from office networks and the internet where possible. Use firewalls and tightly controlled routes between networks. Restrict access through a managed jump machine rather than allowing direct remote connections. Remove unnecessary software and local administrator rights, maintain reliable backups, and agree a lifecycle plan with the machinery vendor.
Compensating controls are not a shortcut. They need to be documented, monitored and reviewed. If the remaining risk is accepted, it should be accepted by someone with the authority to make that decision, not left as an unspoken technical compromise.
Choose controls that protect uptime as well as data
ISO 27001 requires organisations to assess the controls in Annex A and justify which are applicable. The resulting Statement of Applicability is a key certification document, but its real value is in showing why each control matters to your environment.
For many manufacturers, the priority controls will be practical ones: multi-factor authentication for remote and cloud access; separate networks for office, guest, warehouse and production use; tested backups protected from ransomware; monitored endpoint security; controlled administrator accounts; and prompt removal of access when staff or contractors leave.
Patch management needs judgement. Applying every update immediately may not be suitable for a machine controller or application with strict vendor support rules. A sensible approach distinguishes between standard business devices and sensitive production assets. Patch office systems on an agreed cycle, assess industrial patches with the vendor, and use segmentation and access restrictions while a critical system cannot be updated.
Recovery is where many otherwise sound programmes fall short. A backup is only useful if it can be restored within the time your operation can tolerate. Test recovery of the ERP database, engineering files and key configuration data. Include the people who would carry out the recovery, and record the lessons. A successful test gives management credible recovery times rather than assumptions.
Make suppliers and remote access accountable
Manufacturing IT is rarely owned by one party. ERP providers, machine vendors, telecoms companies, cloud platforms, outsourced IT teams and specialist software suppliers may all hold access or process important information. ISO 27001 expects this supply-chain risk to be managed.
Maintain a supplier register and classify suppliers by the access they hold and the operational impact if they fail. Contracts and support agreements should set expectations for confidentiality, incident reporting, data handling, access control and offboarding. For critical suppliers, confirm how quickly they can respond and what their own recovery arrangements look like.
Remote support deserves a separate review. Permanent, shared or undocumented remote-access tools create a straightforward route into the network. Use named accounts, multi-factor authentication, approval for access where appropriate, session logging and time-limited permissions. If a vendor needs urgent access to restore a failed machine, the process should be quick without being uncontrolled.
Prepare evidence before the audit begins
ISO 27001 certification audits test whether the ISMS operates in practice. Auditors will expect more than polished policies. They may sample user access, training records, risk reviews, supplier assessments, backup tests, incident logs, internal audit findings and management-review minutes.
Run an internal audit before engaging the certification body. This should challenge whether teams follow the process, not merely whether documents exist. If production changes have introduced a new connected machine, a new warehouse system or a new external support partner, check that the asset register, risk assessment and access arrangements were updated.
Management review is equally important. Leaders should review security performance, audit findings, incidents, changing risks, resource needs and improvement actions. This keeps accountability with the business rather than placing it solely on an IT manager or external provider.
For organisations in Hampshire, West Sussex or Surrey, a manufacturing-aware IT partner can help translate the standard into controls that respect production constraints. Syn-Star’s approach is to protect the office and shop floor together, with clear ownership, network segregation and recovery planning designed around continuity.
The useful question is not, “Are we ready for an ISO 27001 audit?” It is, “Could we still plan, make, inspect and dispatch if a key system or supplier failed this morning?” Build your ISMS around an honest answer to that question, and compliance becomes a practical by-product of a more resilient operation.
