Connecting your supply chain — supplier portals, EDI, shared planning data, connected equipment — delivers real operational benefit and expands the surface that has to be defended. Manufacturers tend to secure the office network reasonably well and leave the operational side comparatively exposed, largely because it grew up separately and was never meant to be connected at all.

This is a business continuity issue as much as a technical one, which is why it belongs in a supply chain conversation.

Where the Gaps Usually Are

Third-party access. Suppliers, contractors, and service providers with connections into your systems represent risk you don’t control directly. Their security posture becomes yours the moment they’re connected, and most manufacturers have more of these connections than they can list.

Legacy operational equipment. Machine controllers and industrial systems frequently run software that can’t be patched without vendor involvement or production downtime. They were designed for isolated networks and are now, often, not isolated.

The boundary between office and operational networks. Where these connect — and they usually do, for good reasons like production reporting — the connection is a path that needs deliberate control rather than incidental existence.

Data in transit with partners. Planning data, designs, and forecasts moving between organisations, sometimes by methods chosen years ago for convenience.

The Operational Consequence

For manufacturers, the distinctive risk isn’t only data loss. It’s stopped production. An incident that renders planning and scheduling systems unavailable halts output regardless of whether any information was taken, and recovery timelines for operational systems are typically longer than for office systems.

That means the continuity question — can we keep making and shipping product without our systems, and for how long — deserves the same planning attention as a supplier failure. Many manufacturers have never tested it.

Proportionate Steps

Inventory your connections. You cannot protect what you haven’t listed, and the list of third parties with access is usually longer than anyone expects.

Segment networks so that operational systems aren’t reachable from general office access, and so an issue in one area doesn’t propagate freely.

Include security in supplier onboarding proportionate to the access granted. A supplier with system access warrants questions a supplier who only ships boxes doesn’t.

Maintain offline backups of the data you’d need to operate, and confirm you can actually restore from them. Untested backups are an assumption rather than a control.

Write a continuity plan for extended system unavailability — manual fallbacks, what you’d tell customers, who decides what. Then rehearse it, because plans written and never exercised tend not to work.

Where to Start

Map the connections and test the backups. Those two steps expose most of the gap for most manufacturers, and both are achievable without significant expenditure. Anything further should involve a specialist — this is one area where general guidance stops being sufficient quickly.

It’s also worth confirming who in your organisation owns this. In many mid-sized manufacturers, office IT security has an owner and operational technology doesn’t, which leaves the production side unattended by default rather than by decision.

ticktick.ai supports role-based access control and maintains exportable operational data, so critical planning information remains available if primary systems are interrupted.