Manufacturing

Map how production depends on identity services, scheduling, enterprise resource planning, quality systems, engineering files, and supplier communications. A factory may lose effective operation even when its controllers remain untouched. Identify which dependencies have workable alternatives and which require prioritized recovery.

Use Librarian to organize assets, owners, and relationships. Validate network diagrams with plant engineers, including temporary connections and maintenance laptops. Do not assume an environment is isolated because it was designed that way; confirm the current pathways between office systems, production networks, and remote support.

• Document critical recipes, configurations, and engineering-file locations.
• Restrict movement between production cells and general business networks.

Design files, process settings, pricing models, and quality records may be valuable even when an attacker never attempts extortion. Limit access by project and role, review bulk exports, and control external sharing. Include collaboration portals and subcontractor exchanges in the information-handling policy.

Cerberus can support approved data-protection workflows, while Argus can inform credential-exposure investigations. Remote vendor access should be individual, time-limited, and monitored through an approved entry point. Any use of Sleight or active security testing must avoid operational equipment unless plant owners explicitly authorize the scope.

• Remove shared supplier credentials where practical.
• Reassess access when a production contract or engineering project ends.

Recovery plans need more than server backups. Include control configurations, software dependencies, licenses, calibration information, and the checks required before production resumes. Test representative restoration steps in a suitable environment and identify which tasks require equipment manufacturers or specialist contractors.

Dewey can support response coordination and Growler can assist with evidence handling. Operations and safety leaders must approve containment and restart decisions; indiscriminate isolation or automated patching can create additional disruption. Judge may help organize control evidence, but compliance records do not substitute for a demonstrated ability to recover.

• Protect recovery administration from ordinary production credentials.
• Exercise a combined business-system outage and supplier-access compromise.