A Self-Assessment for Production Leaders

Introduction

This checklist is designed for Plant Managers, Operations Directors, and Business Owners. Its purpose is to highlight critical risk areas in your IT and OT (Operational Technology) environment that directly impact production uptime, safety, and proprietary data. Treat each “No” as a potential vulnerability requiring immediate attention.

How to Use It
Gather your operations lead and IT personnel. For each item, mark Yes, No, or Unsure. Be honest—this is for your internal assessment.

Section A: Network & Infrastructure Security (The Digital Perimeter)

• 1. Network Segmentation: Is your production floor/OT network (for machines, PLCs, SCADA) physically or logically separated from the corporate IT network (for email, finance)?
• 2. Next-Generation Firewall: Do you have an advanced firewall with Deep Packet Inspection (DPI) and Intrusion Prevention (IPS) between your network and the internet, not just a basic router?
• 3. Industrial Demilitarized Zone (IDMZ): Is there a controlled buffer zone (IDMZ) between your OT and IT networks to safely facilitate necessary data transfer?
• 4. Secure Wireless: Is all factory Wi-Fi (for logistics, handheld scanners) secured with WPA2-Enterprise or WPA3, with a separate network for guests?
• 5. Vendor Remote Access: Do all third-party vendors (e.g., for machine maintenance) connect via a secure, monitored, and time-limited VPN solution, with their activity logged?
• 6. Network Access Control (NAC): Can unauthorized devices (personal phones, laptops) be prevented from automatically connecting to your production network?
• 7. Port Security: Are unused network ports on switches in offices and on the shop floor disabled?
• 8. Network Monitoring: Do you have a system that alerts you to unusual network traffic patterns or new, unrecognized devices on your network?
• 9. Internet Redundancy: Do you have a backup internet connection (e.g., 4G/5G failover) to maintain critical communications if the primary line fails?
• 10. Router/Firewall Configuration: Are default administrator passwords on all network equipment changed and are firmware updates applied regularly?

Section B: Endpoint & Operational Technology (OT) Security (The Shop Floor)

• 1. Legacy System Inventory: Do you have a complete, documented list of all machines and PCs running unsupported OS (Windows 7/XP, etc.) and a risk mitigation plan for each?
• 2. Endpoint Detection & Response (EDR): Is advanced EDR or anti-malware software installed and actively monitored on ALL PCs, including those on the shop floor?
• 3. OT-Specific Antivirus: For machines that cannot run standard software, are OT-specific, whitelisting-based security solutions in place?
• 4. Patch Management Policy: Is there a formal, risk-assessed process for applying security patches to Windows, engineering software, and machine HMI software within an agreed timeframe (e.g., 30 days)?
• 5. USB Port Control: Are USB ports on critical production machines and engineering stations disabled, or is usage strictly controlled via technical policies and scanning?
• 6. Physical Access to Machines: Is physical access to PLCs, HMIs, and network cabinets on the production floor restricted to authorized personnel only?
• 7. Application Whitelisting: Are engineering workstations configured to only run pre-approved software to prevent unauthorized tool installation?
• 8. Default Password Elimination: Have all default passwords on HMIs, PLCs, and other embedded devices been changed to strong, unique passwords?
• 9. Backup of Machine Configs: Are configurations, programs, and recipes for all critical machines (CNC, PLC, Robotics) backed up regularly and stored securely offline?
• 10. OT Network Diagrams: Do you have up-to-date and accurate network diagrams that show how all production machines and controllers are connected?

Section C: Data Protection & Recovery (Your Intellectual Property)

• 1. 3-2-1 Backup Rule: For critical data (designs, configs, recipes), do you have at least 3 total copies, on 2 different media, with 1 copy stored offline/immutable?
• 2. Backup Scope Verification: Do your backups definitively include all critical assets: CAD/CAM libraries, machine configs, ERP/MES data, and administrative servers?
• 3. Immutable/Offline Backup: Is at least one backup copy completely air-gapped or in an immutable (cannot be altered/deleted) cloud format to resist ransomware encryption?
• 4. Recovery Time Objective (RTO): Do you have a defined and tested RTO (e.g., 4 hours) for your most critical production systems, and do your backups support it?
• 5. Biannual Restoration Test: Have you performed a full test restoration of a critical server or machine image in the last 6 months, documenting the results?
• 6. Intellectual Property Access Logs: Can you track and audit who accessed, copied, or modified sensitive design files (e.g., CAD, BOM) and when?
• 7. Data Encryption: Is sensitive data encrypted both when stored (at rest) on servers and when transmitted (in transit) to external partners?
• 8. Email Data Loss Prevention (DLP): Are there technical controls to prevent employees from accidentally emailing sensitive design files to personal accounts or outsiders?
• 9. Cloud Storage Governance: If using cloud storage (OneDrive, Google Drive), is it a managed company account with access controls, not a collection of personal accounts?
• 10. Secure File Transfer: Do you have a secure, company-managed method (not personal email/USB) for sharing large files with suppliers and customers?

Section D: Human Factors, Policies & Response (Your People & Plans)

• 1. Regular Phishing Simulations: Do all staff, including shop floor supervisors, undergo simulated phishing attacks and training at least quarterly?
• 2. Incident Response Plan (IRP): Is there a simple, written plan that defines roles and first steps if a cyber incident (e.g., ransomware) is detected? Does it include who to call (e.g., your MSP, authorities)?
• 3. Vendor Security Assessment: Do you require cybersecurity assurances or assessments from key suppliers and third parties who connect to your systems?
• 4. Employee Offboarding Process: Are network and system access rights revoked immediately when an employee or contractor leaves the company?
• 5. Principle of Least Privilege: Are user accounts configured with only the minimum access needed for their job function (e.g., an operator doesn’t have engineering software admin rights)?
• 6. Security Awareness Training: Is formal cybersecurity training provided to all new hires and refreshed annually for all staff?
• 7. Mobile Device Management (MDM): Are company-owned mobile devices (tablets, phones) used on-site secured, encrypted, and managed?
• 8. Password Policy Enforcement: Is a strong password policy (minimum length, complexity) enforced by your systems, with multi-factor authentication (MFA) enabled for all remote and administrative access?
• 9. Change Management: Is there a process to review, approve, and document changes to network, machine, or critical software configurations before implementation?
• 10. Cyber Insurance: Do you have a dedicated cyber insurance policy, and have you verified that your security measures meet its requirements for coverage?

Scoring & Next Steps

Tally your results:

• Yes: A controlled risk. Maintain these standards.
• No / Unsure: A potential vulnerability that requires planning and action.

If you have 10 or more “No/Unsure” responses: Your operation has significant exposure that could lead to production stoppage, data theft, or financial loss. A formal risk assessment is strongly recommended.

If you have 5-9 “No/Unsure” responses: You have foundational controls but contain critical gaps. Prioritizing and closing these gaps should be a key business initiative.

This checklist is a snapshot. The threat landscape evolves daily. Regular review is essential.

Ready to turn your “No’s” into a managed action plan?
Contact us for a professional vulnerability assessment.