IT for Manufacturers: OT, IT and Cybersecurity for SME Manufacturing

In an SME manufacturing business, two worlds that once barely spoke to each other now run side by side. In the office you have laptops, Microsoft 365 and an ERP; on the shop floor you have PLCs, SCADA, CNC machines and robots. As soon as you connect them (and every modern factory does) you get a single attack surface, a single compliance question and a single chain in which one weak link can bring the whole of production to a halt. This guide shows how an SME manufacturer can set up its IT and OT in practice in 2026, what the Dutch Cybersecurity Act requires of you, and which steps really make a difference.

Why IT in manufacturing is about two worlds

In manufacturing, everything that keeps your office running is called "IT" and everything that keeps production running is "OT" (operational technology). OT covers the PLCs that drive a conveyor, the SCADA systems that sit on top of them, the robots, the energy and cooling systems, and the cameras on the production floor. Historically, OT sat on an isolated network, ran on specialised operating systems and was rarely updated. Today, OT is connected to your MES, your ERP, a cloud dashboard and sometimes even directly to your supplier via remote access.

That convergence brings benefits: real-time data, predictive maintenance and tighter quality control. But it also comes at a price. A phishing email in the office can, through poor network segmentation, yield stolen credentials that reach all the way down to the PLC layer. And unlike an office incident, in production you can't just "quickly restart it". A single day of downtime can easily cost a week's revenue.

The Dutch Cybersecurity Act and your manufacturing business

The Dutch Cybersecurity Act (Cyberbeveiligingswet), the national implementation of NIS2, came into force in mid-2026 (Bulletin of Acts and Decrees 2026, 187). More than 8,000 Dutch organisations fall under it. Manufacturing is listed in Annex II (other critical sectors).

For an SME manufacturer, the rule of thumb is: is your sector covered by NIS2, and do you have 50 or more employees or more than €10 million in turnover or balance sheet total? Then you are an "important entity". Among other things, that means a demonstrable security policy, a risk assessment, an obligation to report incidents within 24 hours (early warning) with a fuller picture within 72 hours, and management liability. Fines for important entities can reach €7 million or 1.4% of your global annual turnover.

So you need to go well beyond "we have antivirus". Our complete guide to NIS2 for SMEs explains the duty of care in detail; the rest of this article focuses specifically on manufacturing.

What the threat landscape looks like for industry

Internationally, industry has topped the ransomware charts for months. In the twelve months from March 2025, NCC Group recorded 2,073 ransomware attacks on industrial organisations, and the sector was the most targeted in every single month of that period. In the Netherlands, industry voices confirm the same picture: the attack surface created by connecting OT to corporate IT is growing fast, and it is rarely a question of "maybe" any more.

The attacks fall into three patterns: ransomware with double extortion (encrypt first, then threaten to leak), supply chain attacks via suppliers who log in remotely to your installation, and targeted espionage aimed at trade secrets (recipes, drawings, machine settings). Each needs different mitigations, but they share one common factor: the attack rarely starts in OT. It starts in the office and then walks onto the production floor.

The Purdue model and IEC 62443, in plain English

For thirty years, the Purdue model has been the reference framework for OT segmentation. It divides your environment into five levels plus an industrial DMZ:

• Level 0: the physical process (sensors, actuators).
• Level 1: control (PLCs, DCS).
• Level 2: supervisory (SCADA, HMI).
• Level 3: operations (historian, MES, local servers in the factory).
• Level 3.5: the industrial DMZ, the boundary between OT and IT.
• Levels 4 and 5: enterprise IT (ERP, office, cloud).

The key is that traffic between these levels passes through a firewall, and that your lower OT levels (0, 1 and 2) never talk directly to the internet or the office. That is the "zones and conduits" idea from IEC 62443, the international standard for industrial cybersecurity.

IEC 62443 defines four security levels (SL1 to SL4). For most SME factories, SL2 is an achievable and realistic goal: protection against targeted attacks with limited resources. SL3 is for critical components within your process; SL4 is for national infrastructure. The Purdue model is criticised as too flat for cloud and the Industrial IoT, but it remains a workable foundation as long as you enforce the DMZ boundaries.

Seven focus areas for an SME manufacturer

1. Asset inventory, including OT

You can't protect what you don't know about. Many manufacturers have an inventory of their office equipment but no overview of OT: which PLCs, which firmware, which engineering workstations, which serial connections. Start here. A combination of passive network discovery (tools that listen without disrupting anything) and a manual inventory works well at SME scale.

2. Network segmentation

Separate OT and IT with a firewall, and segment within OT at cell level. Every production line and every group of machines in its own zone. No more "flat network". Ideally, invest in industrial firewalls that can also inspect OT protocols (Modbus, OPC UA, Profinet).

3. Secure remote access for maintenance

Suppliers want to log in remotely to "their" machines. That has to be possible, but not through an always-on VPN or with shared passwords. Put a jump host or a managed remote access tool in the DMZ, with MFA, session logging and just-in-time access. In practice, this is the most abused channel.

4. Patching and legacy systems

Not every PLC can be kept up to date; some machines are certified on a specific firmware version. Compensate: isolate, monitor and apply application whitelisting on engineering workstations. For office IT, standard patch management applies; our explainer on patch management covers the basics.

5. Endpoint protection on every engineering workstation

Engineering PCs that program PLCs are a major risk. Some still run Windows 7 or 10 without support and are used for both email and production. Separate the roles (office PC versus engineering PC), install a modern EDR on every machine that can run one, and use USB controls.

6. Backup and recovery, including configurations

In production, backup means more than your office data. PLC configurations, SCADA project files, batch recipes, HMI screens, machine measurements: without restored configurations, an incident takes days rather than hours. Back up offsite and test a full restore at least twice a year.

7. Monitoring, logging and incident process

NIS2 requires a working incident process with defined reporting deadlines. Centralise logs (including SCADA events where possible), define what counts as an incident and who does what. At SME scale, outsourcing to a managed detection and response partner usually makes more sense than staffing a 24/7 team yourself. Our comparison of MSSP, MSP and managed detection and response helps you make that choice.

Which IT stack suits an SME manufacturer

Beyond the OT layer, a modern manufacturer typically has an office stack with Microsoft 365 or Google Workspace, an ERP (often SAP Business One, Microsoft Dynamics 365 Business Central, AFAS or Exact), an MES as the bridge between ERP and production, a PLM for product and drawing management, and a maintenance application (CMMS). How well these layers integrate determines how efficiently you run, and how resilient you are.

The mistake we often see: the ERP moves to the cloud, but the MES still sits on a standalone server next to the production floor, with no backup and no monitoring. Treat that MES server as a critical business system, not as "something that runs because the plant is there". Our step-by-step guide to modernising IT infrastructure helps you clear that kind of backlog in phases.

Common mistakes in production IT

• A flat network with no separation between OT and IT. The biggest source of ransomware escalation in manufacturing.
• Supplier VPNs without MFA. Every external party has its own VPN, each with its own password. Centralise this in a managed remote access solution.
• No asset inventory for OT. If you don't know which PLCs you have, you can't protect them.
• An "old PC" for machine control that is also used for email and browsing.
• No backup of PLC and SCADA configurations. Backing up only data means recovery after an incident takes days.
• Treating compliance as an annual project. NIS2 is not a one-off audit but a continuous process.

How to get started: a practical 90-day plan

1. Weeks 1 to 3: baseline. OT asset inventory, network diagram, risk assessment of your three most important production lines.
2. Weeks 4 to 6: segmentation. Firewall between OT and IT, DMZ set-up, basic rules. Start broad and refine later.
3. Weeks 7 to 9: access and backup. Managed remote access for suppliers, backup of PLC and SCADA configurations.
4. Weeks 10 to 12: monitoring and documentation. Centralise logging, document the incident process, and put a demonstrable risk assessment and duty of care in place under the Dutch Cybersecurity Act.

This isn't the whole journey, but it is a healthy foundation that covers most SME risks and brings you in line with NIS2.

Frequently asked questions about IT for manufacturers

What exactly is the difference between IT and OT? IT (information technology) is the world of your office: laptops, servers, email, ERP and cloud. OT (operational technology) is the world of your production floor: PLCs, SCADA, robots, measuring equipment and HMIs. OT has strict availability and safety requirements that IT doesn't, and uses protocols (Modbus, OPC UA, Profinet) that a standard IT firewall can't inspect properly.

Does the Dutch Cybersecurity Act apply to me as a small manufacturer? If you are in manufacturing and have more than 50 employees or more than €10 million in turnover or balance sheet total, the act applies to you as an "important entity". Below that, it generally doesn't, although customers (especially in supply chains with an OEM above you) may still impose NIS2-style requirements because they have to comply themselves. If in doubt, check the official registration process of the NCSC (the Dutch National Cyber Security Centre).

Do I need to set up my own SOC for OT monitoring? It rarely pays off for an SME. Staffing a 24/7 operation is usually too expensive for a single factory. In most cases, a managed detection and response partner with OT expertise is the more pragmatic route. What matters is that the partner understands both IT and OT; standalone SOCs that can only monitor office IT miss half the picture.

How quickly must an incident be reported? Under NIS2, there is a 24-hour "early warning" deadline, a fuller incident notification within 72 hours and a final report within one month. Write this into your incident procedure in advance, so you aren't reaching for the phone in a panic in the middle of an attack.

Can I keep old PLCs secure without replacing them? Often you can, if replacement isn't an option. Put them in their own network segment behind an industrial firewall, log all traffic, apply application whitelisting on the engineering workstations that talk to them, and keep an offline backup of their configurations. That covers most of the risk without having to replace expensive machines.

Roughly what does this cost? It depends on size. A baseline programme for an SME factory of around 50 employees (segmentation, managed remote access, EDR, backup, monitoring) easily starts at a few thousand euros a month with a managed partner, plus project costs for the initial set-up. Doing it yourself requires specialist knowledge that you rarely bring in-house for less.

Conclusion

In manufacturing, IT no longer stays in the office. As soon as you connect OT and IT, you take on a wider attack surface, stricter compliance demands and greater dependency. The fundamentals are well known and achievable: segment OT from IT, set up an industrial DMZ, manage remote access centrally with MFA and logging, back up your configurations too, and put an NIS2-compliant incident process in place. Do this step by step, and 90 days is enough to substantially reduce the most important risks.

Struggling to reconcile production realities with NIS2, or looking for a partner who understands both IT and OT? TRON Group guides SME manufacturers from asset inventory to phased segmentation and managed monitoring. Call +31 85 303 5869 for a no-obligation chat, or explore our cybersecurity practice for SMEs to arrange an initial conversation.