Key takeaways
- The instinct to run the same vulnerability scanner used on office laptops against the shop floor is a common and risky mistake.
- Treat the CPGs as a floor, not a finish line: CISA is explicit that they are "a floor — not a ceiling" of protections, and they are voluntary guidance, not a legal requirement.
- Legacy PLCs and drives with no security features to turn on.
- Get a passive read of the shop-floor network before buying anything — you need the device list before you can prioritize.
A food processor with one PLC-driven line, a parts machine shop with three CNC cells, or a regional utility workshop usually has no one whose job title includes "OT security." Most OT/ICS guidance, including the long-running NIST SP 800-82 and the IEC 62443 series, is written at a scale that assumes a security team, a budget line and a segmented network already exist. This guide is for the plant that has none of those yet, and needs a sequence that does not start with buying a platform or installing something on a 15-year-old controller.
Start with what you have, not what you should buy
CISA's own OT asset-inventory guidance puts it directly: "without an inventory, organizations do not know what they have and what should be secured." Before any framework, tool or policy, a small manufacturer needs a current list of what is actually on the shop-floor network: PLC models and firmware versions, HMI software, drives, gateways, remote-access devices, and how they are connected. Asset inventory is itself one of CISA's own Cross-Sector Cybersecurity Performance Goals (CPGs), not an optional preliminary step.
Why "just scan it" is the wrong first move
The instinct to run the same vulnerability scanner used on office laptops against the shop floor is a common and risky mistake. Many PLCs, drives and legacy gateways were built decades ago with a minimal network stack, and were never tested against the kind of traffic an IT-style active scanner generates. Industry practice built around NIST SP 800-82 Rev. 3 treats active scanning of a live OT network as a real availability and safety risk, since it can overload or crash a legacy device's network stack, and instead favours passive, non-intrusive discovery — reading a copy of network traffic from a SPAN port or a network TAP — as the safer way to build an inventory and watch for anomalies without touching production. Active scanning, where it is used at all, is normally kept to a planned maintenance window or a test bench, not the live line.
This is also why "install an agent on every device" rarely works in OT the way it does in IT: most PLCs and drives have no supported way to run one.
A sequence for a plant with no OT security team
| Step | What it is | Why first |
|---|---|---|
| 1. Passive asset inventory | Read mirrored shop-floor traffic (SPAN/TAP) to list devices, protocols, firmware versions | You cannot secure what you have not identified; CISA treats this as foundational, not optional |
| 2. Pick a small set of CPGs | Start from CISA's prioritized, cross-sector list rather than a full framework | CISA designed the CPGs specifically to be achievable for small and medium organizations with limited resources |
| 3. Segment and restrict remote access | Separate the OT network from the office network; lock down vendor/contractor remote-access paths | The highest-value, lowest-cost control once you know what is connected |
| 4. Add monitoring, still passive | Watch for new devices or unusual traffic patterns against the baseline from step 1 | Builds on the same non-intrusive technique, no new risk to production |
| 5. Grow into IEC 62443-2-1 | Build a documented cybersecurity management system (CSMS) as the plant matures | The structured next step once basics are in place, not a starting point |
CISA's Cross-Sector Performance Goals: built for exactly this gap
The Cross-Sector Cybersecurity Performance Goals (CPGs) exist specifically because CISA recognised most critical-infrastructure operators, manufacturing among them, are not large enough to run a full NIST CSF programme on day one. CISA's own description frames them as a tool to help "small- and medium-sized organizations kickstart their cybersecurity efforts," and its CPG 2.0 report (December 2025) states its goal-selection criteria require every goal to be "reasonably straightforward and not cost-prohibitive for small- and medium-sized entities to successfully implement." The 2.0 revision also merged what used to be separate IT and OT goal lists into one shared set, specifically so a small manufacturer running both an office network and a shop floor does not need two frameworks.
Treat the CPGs as a floor, not a finish line: CISA is explicit that they are "a floor — not a ceiling" of protections, and they are voluntary guidance, not a legal requirement. A small manufacturer that also makes or integrates machinery sold into the EU may separately have legal obligations under the Machinery Regulation or the Cyber Resilience Act, which run on their own statutory timelines regardless of what voluntary programme a plant follows internally.
Legacy devices and remote access: the two recurring weak points
Two problems show up repeatedly in small manufacturing environments, and neither is solved by a tool alone:
Legacy PLCs and drives with no security features to turn onCompensating controls — network segmentation, restricting who can reach the device, monitoring its traffic for anomalies, and physical access control — carry more of the load here than anything installed on the device itself, because there is often nothing to install. Vendor and integrator remote accessA machine builder's or OEM's remote-support VPN is frequently the least controlled path into the plant network: shared credentials, always-on tunnels, no session logging. Reviewing and tightening these connections is consistently one of the highest-value, lowest-cost steps a small plant can take, and it does not require new hardware.
Recent US federal guidance reinforces the same direction at a national-infrastructure scale: the April 2026 joint guide from CISA, the Department of War, DOE, FBI and DOS on applying zero-trust principles to OT describes the task as addressing "technology gaps from legacy infrastructure, operational constraints, and the safety requirements that come from the critical link between cybersecurity and physical processes" — the same constraints a small plant faces, just without the enterprise budget to match.
What a small manufacturer should do this quarter
Get a passive read of the shop-floor networkbefore buying anything — you need the device list before you can prioritize. Pick 3-5 CPGs that match your biggest gaps, not the full list; CISA designed them to be implemented incrementally. Separate the OT network from the office networkif it is not already, and inventory every remote-access path a vendor or integrator uses. Document what you find, even informally — it is the starting evidence for IEC 62443-2-1 later and for any customer or insurer questionnaire today. Revisit scope once the business grows: a structured IEC 62443-2-1 security program or the Purdue model for network zoning become worth the investment once the basics are in place.
SoftWSP reads a plant's actual shop-floor traffic and produces an asset inventory and exposure report without installing anything on the OT network, and without active scanning that could disrupt production: see OT Snapshot. For the device-maker side of the supply chain feeding into your plant, see device firmware security.
This guide is general information, not a substitute for a site-specific risk assessment.
Sources
- CISA: Foundations for OT Cybersecurity — Asset Inventory Guidance for Owners and Operators
- CISA: Cross-Sector Cybersecurity Performance Goals
- CISA: Cross-Sector Cybersecurity Performance Goals, Version 2.0 (PDF, December 2025)
- CISA, DoW, DOE, FBI, DOS: Adapting Zero Trust Principles to Operational Technology (29 April 2026)
- NIST SP 800-82 Revision 3: Guide to Operational Technology (OT) Security
Frequently asked questions
Our factory has no dedicated OT security team. Where do we actually start?
With an asset inventory, not a tool purchase. CISA's own OT asset inventory guidance states plainly that "without an inventory, organizations do not know what they have and what should be secured," and treats building one as one of its Cross-Sector Cybersecurity Performance Goals (CPGs). For a small manufacturer, the practical starting point is a passive read of shop-floor network traffic — PLCs, HMIs, drives and their IP addresses, protocols and firmware versions — before deciding what, if anything, to install.
Can we just apply the same enterprise IT security tools we already use in the office?
Not directly to the OT network. CISA's own framing of the Cross-Sector Cybersecurity Performance Goals is that they are designed to help "small- and medium-sized organizations kickstart their cybersecurity efforts" with a small number of high-impact actions, rather than a comprehensive enterprise programme — CPG 2.0 explicitly merged separate IT and OT goal sets into shared ones so a small organization can use one framework "without confusion over domain-specific goals." Even so, OT devices themselves differ from IT endpoints: many PLCs and drives cannot safely run a host agent or tolerate an unplanned reboot, which is why discovery methods matter as much as the framework chosen.
Why does passive network monitoring come up so often for OT instead of just scanning the network?
Because many OT devices are old, resource-constrained, and were never built to handle unexpected network traffic gracefully. Industry practice built around NIST SP 800-82 treats active, IT-style scanning of a live OT network as a risk to availability and even safety, since it can overload a legacy controller's network stack, and instead favours passive, non-intrusive techniques — reading mirrored traffic from a SPAN port or network TAP — as the safer default for building an inventory and watching for anomalies, reserving active scanning for maintenance windows or a test bench.
Are the CISA Cross-Sector Cybersecurity Performance Goals mandatory for a small manufacturer?
No. CISA's own CPG 2.0 report (December 2025) describes the CPGs as "a prioritized subset of IT and OT cybersecurity practices" and states CISA intends them to be "a floor — not a ceiling." They are voluntary, cross-sector guidance, not a regulation; a small manufacturer selling machines or components into the EU may separately need to meet the Machinery Regulation or Cyber Resilience Act, which are legal obligations with their own timelines.
We outgrow the basics — what's the next step up from CPGs?
IEC 62443-2-1, the part of the IEC 62443 series that sets out an asset owner's security program (a cybersecurity management system, not a single checklist), is the usual next step once a plant has its inventory and basic controls in place. It is a much larger undertaking than the CPGs, graded by a maturity model rather than a pass/fail check, so most small manufacturers use it as a direction to grow into rather than a near-term target.
In this cluster
