CISA Guidance: Is Your Plant Floor Exposed?
Published on by Bryan Gayhart in Manufacturing, Wholesale / Distribution, Technology
- CISA’s Internet Exposure Reduction Guidance highlights cybersecurity risks associated with internet-facing IT and operational technology (OT) assets, including equipment on manufacturing plant floors.
- The guidance extends beyond critical infrastructure, with important considerations for manufacturers using connected equipment and remote monitoring systems.
- Vendor-installed connections can create hidden vulnerabilities, particularly when cellular modems and remote-access tools operate outside routine IT security scans.
- CISA outlines four steps to reduce internet exposure: identify exposed assets, evaluate whether access is necessary, secure essential connections, and strengthen remote access controls.
- A complete inventory of internet-facing equipment is an important starting point for identifying potential security gaps and reducing risks across the plant floor.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued Internet Exposure Reduction Guidance addressing a cybersecurity risk manufacturers may not realize they have: equipment on the plant floor that’s accessible through the public internet without their IT team’s knowledge.
The guidance aligns with CISA’s broader Cross-Sector Cybersecurity Performance Goals, which emphasize foundational controls across both IT and operational technology (OT) environments, including asset inventories, patch management, logging, and restrictions on unauthorized devices.
The guidance calls out programmable logic controllers (PLCs), human-machine interfaces (HMIs), remote terminal units, and industrial Internet of Things (IoT) devices as common sources of unmanaged exposure. It specifically flags vendor- or integrator-installed cellular modems as a recurring blind spot because they frequently bypass an organization’s normal network security scans.
Who’s affected?
This applies most directly to manufacturers running equipment that vendors, integrators, or maintenance contractors can access remotely, which is a significant amount of equipment on modern plant floors. It’s also relevant anywhere enterprise resource planning (ERP) or manufacturing execution systems (MES) connect to production equipment for scheduling, monitoring, or predictive maintenance, since that connectivity is an increasingly common ransomware target.
This includes:
- Plants with vendor- or OEM-installed remote monitoring or telemetry equipment
- Manufacturers whose ERP or MES systems connect to production-floor equipment
- Companies that allow direct remote access to PLCs or HMIs for maintenance or troubleshooting
- Operations that haven’t recently inventoried their internet-facing OT assets
What does this mean for your business?
CISA’s framework offers practical steps manufacturers can take to reduce unnecessary internet exposure. The four recommendations translate directly to plant-floor priorities:
- Assess your current exposure: Identify every IT and OT asset that’s reachable from the internet, including anything installed by a vendor or integrator that IT may not know about.
- Evaluate whether access is necessary: Determine which exposed assets need to be internet-accessible for daily operations and remove or restrict access to those that don’t.
- Secure what must remain exposed: Change default credentials, apply current security patches, and retire hardware or software that’s no longer supported.
- Strengthen remote access control: Route necessary remote access through a secure, centrally managed gateway or VPN with strong authentication rather than connecting directly to a PLC, HMI, or remote terminal unit.
The underlying message applies well beyond critical infrastructure: a stolen credential shouldn’t provide access to your production floor, but in many manufacturing environments, it still can.
Not sure where your exposure stands?
An asset inventory and exposure assessment can help uncover gaps that aren’t always easy to spot, especially when vendor-installed remote access has expanded over time.
Our IT Controls and Cybersecurity pros help manufacturers identify internet-facing IT and OT assets, evaluate remote access controls against CISA’s guidance, and determine where a SOC readiness review could help strengthen their position with customers and insurers.
Have questions about your organization’s cybersecurity risks? Contact us today for a free consultation. We’re here to help you figure out the next steps.
Related resources
Cybersecurity starts with understanding where your risks are. See how our IT Controls Services help businesses strengthen their internal controls, or take a deeper dive into identifying potential vulnerabilities with our Cybersecurity Assessment. For more on evaluating security controls and preparing for SOC reporting, check out our SOC Reporting Toolkit.
