# Manufacturing IT Resilience Maturity Assessment > Source: https://netray.co/tools/manufacturing-it-resilience-maturity-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer ten questions about backups, redundancy, monitoring, patching and recovery to see how resilient your plant IT is and what to fix first. ## Category erp-operations ## Audience - IT manager - CIO - Plant manager - Infrastructure engineer ## Tool **Kind:** assessment **Questions:** #### How are your ERP and MES backups protected? **Help:** Think about ransomware and accidental deletion. **Options:** ##### Backups sit on the same network and domain as production **Score:** 0 ##### Separate storage but the same admin credentials **Score:** 1 ##### Separate storage and credentials, one copy off site **Score:** 2 ##### Offline or immutable copy, separate credentials, tested **Score:** 3 #### When did you last restore the ERP database to a test server? **Options:** ##### Never **Score:** 0 ##### More than two years ago **Score:** 1 ##### Within the last 12 months **Score:** 2 ##### At least twice a year with timing recorded **Score:** 3 #### How would you describe redundancy for the ERP and database servers? **Options:** ##### Single physical servers, no spare **Score:** 0 ##### Virtualised on one host with spare hardware on the shelf **Score:** 1 ##### Virtualised cluster so a host failure restarts workloads **Score:** 2 ##### Cluster plus a tested replica or standby at a second location **Score:** 3 #### How is the plant network segmented? **Options:** ##### One flat network **Score:** 0 ##### Office and plant are separate but with broad rules between them **Score:** 1 ##### Separate zones with firewall rules limited to required traffic **Score:** 2 ##### Zones and conduits documented, DMZ for data exchange, rules reviewed **Score:** 3 #### How do you handle patching of servers and network gear? **Options:** ##### Ad hoc, when something breaks **Score:** 0 ##### Regular for Windows, not for the rest **Score:** 1 ##### Scheduled cycle with a test step and exceptions list **Score:** 2 ##### Risk ranked, tracked, with compensating controls for what cannot be patched **Score:** 3 #### What monitoring do you have over core systems? **Options:** ##### Users tell us when something is wrong **Score:** 0 ##### Basic up and down checks **Score:** 1 ##### Metrics, logs and alerts for servers, storage, network and backups **Score:** 2 ##### Monitoring with on-call rota, runbooks and trend reviews **Score:** 3 #### How current is your asset inventory and network documentation? **Options:** ##### Mostly in people's heads **Score:** 0 ##### Spreadsheets that are often out of date **Score:** 1 ##### Maintained inventory and diagrams reviewed yearly **Score:** 2 ##### Discovery tools feed a maintained inventory with owners **Score:** 3 #### How well is the power and environment for the server room protected? **Options:** ##### No UPS or cooling monitoring **Score:** 0 ##### UPS present but never tested **Score:** 1 ##### UPS tested yearly, temperature alarms **Score:** 2 ##### UPS and generator tested under load, automatic shutdown tested **Score:** 3 #### Do you have a written, tested disaster recovery plan for ERP? **Options:** ##### No plan **Score:** 0 ##### A plan exists but was never exercised **Score:** 1 ##### Plan with owners, exercised in the last two years **Score:** 2 ##### Plan exercised yearly with recovery times measured against targets **Score:** 3 #### How do you manage vendor and remote access to plant systems? **Options:** ##### Permanent VPN or shared remote tools **Score:** 0 ##### Named accounts, no extra controls **Score:** 1 ##### Multi factor authentication through a jump host **Score:** 2 ##### Approved, time limited sessions that are logged and recorded **Score:** 3 **Bands:** #### Exposed **Min:** 0 **Max:** 29 **Verdict:** A single failure or attack could stop production for days, and recovery would rely on luck and individual effort. **Recommendations:** - Make a verified, offline copy of ERP and file server backups this month - Restore the ERP database to a test server and time it - Document who to call and what to do in an outage - Close any direct remote access to plant systems #### Basic **Min:** 30 **Max:** 54 **Verdict:** Core controls exist but many are untested or inconsistent. Recovery is possible, but slow and uncertain. **Recommendations:** - Schedule restore tests and record results - Segment plant networks and review inter-zone firewall rules - Add monitoring and alerts for backups, storage and UPS - Write a one page recovery plan for each critical system #### Managed **Min:** 55 **Max:** 79 **Verdict:** You have documented, tested practices in most areas. The next gains come from measurement and rehearsal. **Recommendations:** - Measure recovery time against agreed targets - Run a tabletop exercise with operations and leadership - Reduce patch exceptions on OT with compensating controls - Review vendor access logs monthly #### Resilient **Min:** 80 **Max:** 100 **Verdict:** Your practices are tested, measured and improved. Keep them current as systems and people change. **Recommendations:** - Repeat recovery drills at least yearly and after major changes - Track recovery time and incident trends - Review third party and supplier dependencies - Share lessons from drills with plant leadership ## Content **Intro:** Resilience is the ability to keep making and shipping product when something fails. This ten question assessment gives IT managers a quick view of where they stand and what to fix first, using plain language rather than a heavy framework. **Sections:** #### How to use the assessment **Body:** Answer each question for your main plant or data centre, picking the option that matches what is true today rather than what is planned. Involve the people who run backups, the network and the plant floor, because answers differ by role. The score gives a band and a short list of actions. Re-run the assessment every six months to track progress. **Bullets:** - Answer from evidence, not intention - Use the worst case across your critical systems - Share the result with operations leadership - Retake after each improvement project #### What the ten questions measure **Body:** The questions cover backup protection, restore testing, redundancy, network segmentation, patching, monitoring, documentation, power and environment, disaster recovery planning and remote access. These are the areas that most often decide whether an ERP outage lasts hours or days. They reflect common guidance such as the NIST Cybersecurity Framework functions of identify, protect, detect, respond and recover. #### Reading your band **Body:** Exposed and Basic scores mean that fundamentals need attention before advanced projects. In Managed, the gap is usually practice: plans exist, but were not exercised or measured. Resilient does not mean risk free; it means you know your recovery times and have rehearsed them. Compare the score to the cost of an hour of downtime in your plant to prioritise spend. #### Common mistakes **Body:** Self assessments tend to be optimistic, especially for backups and documentation. Ask for proof, such as a restore log. Another mistake is looking only at servers and ignoring the shop floor dependencies: label printers, scanners, CNC network drives and the MES. Include them in your scope. **Cta:** If you want a second opinion on the result, Netray can review your ERP and data platform recovery design. The assessment is complete and free without contacting us. **Faq:** #### Is this a formal audit? **Answer:** No. It is a self assessment for planning. It does not certify compliance with ISO 27001, IEC 62443 or any other standard, and it is not a substitute for a qualified assessor. #### What score should I aim for? **Answer:** Aim to remove zero scores first, then raise each area to at least two. The right target depends on the cost of downtime. A plant that loses a large amount per hour should reach the Managed or Resilient bands for ERP and the network. #### Which area should I improve first? **Answer:** Usually backups and restore testing, because they limit the damage from almost every failure. Then segmentation and remote access, then monitoring and documentation. #### How often should I redo it? **Answer:** Every six months and after major changes such as an ERP upgrade, a data centre move or an acquisition. Keep earlier results to show progress to management. ## Search terms it resilience assessment, manufacturing it maturity assessment, erp availability assessment, disaster readiness score, infrastructure maturity model, plant it risk assessment, it operations maturity, business continuity self assessment --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json