Ransomware Readiness Assessment for Manufacturers
Ransomware crews target manufacturers because downtime is expensive and plants often run old, flat networks. This assessment gives an IT security lead a fast, honest read on how prepared a site is, and what to fix first.
1. How are your backups protected from being encrypted or deleted by an attacker?
Think about the backup server, its credentials and where copies live.
2. When did you last restore your ERP database and a plant system from backup in a test?
3. How is the IT network separated from the plant floor (OT) network?
4. Where is multi-factor authentication enforced?
5. How quickly are internet-facing systems patched when a critical vulnerability is published?
6. Do you have endpoint detection and response (EDR) with someone watching alerts?
7. How current is your written incident response plan and contact list?
8. Could the plant keep shipping for a few days on manual procedures if the ERP and MES were down?
9. How well do you know what is on your network, including OT devices?
10. How are privileged and vendor remote accounts managed?
How to use the assessment
Answer for one site at a time, choosing the option that describes what is true today, not what is planned. If two people disagree, take the lower score. The score is the share of the maximum points across ten control areas, then mapped to four bands. Print or export the result and attach it to your risk register so you can show movement over time. It works best when the IT lead, a plant engineer and someone who owns the ERP answer together, because each sees different parts of the picture.
- Score each plant separately if networks differ
- Take the lower score when unsure
- Re-run after every major change or incident
What the ten questions measure
The questions follow how ransomware incidents actually unfold in manufacturing: initial access through remote services or phishing, movement from IT into the plant network, destruction of backups, and a slow recovery because nobody had restored the ERP or MES under pressure. They map loosely to common frameworks such as NIST CSF functions and the IEC 62443 idea of zones and conduits, but this is a quick self-check, not an audit or a certification.
- Prevent: MFA, patching, segmentation, privileged access
- Detect: EDR and monitoring, asset visibility
- Respond: written plan and exercises
- Recover: tested backups and manual operating procedures
Reading the result and common mistakes
A low band does not mean you are about to be attacked, it means recovery would be painful. The most common mistake is counting backups that were never restored. A second is assuming the plant firewall exists because a firewall appliance was bought. A third is ignoring vendor support access to CNC controllers, PLCs and ERP servers. Treat any zero as a project, and any answer you could not verify as a zero until someone checks.
- Backups that have never been restored are untested, not protected
- Check firewall rules, not just the presence of a device
- Include contractors and OEM remote support in your answers
Frequently Asked Questions
Is this a formal security audit?
No. It is a self-assessment for orientation. A formal review would verify configurations, test restores and review firewall rules. Use the score to decide where to look first and to brief management, not as evidence of compliance with any standard.
Why does the assessment ask about manual procedures?
Most plants cannot restore everything at once. How long you can keep building and shipping on paper travelers and printed schedules often decides how costly an incident is, so it is scored alongside technical controls.
Does it cover OT specifically?
Several questions do: segmentation between IT and OT, OT asset inventory, vendor remote access and restoring plant servers. It does not replace an IEC 62443 risk assessment of individual control systems.
Does my data leave the browser?
No. The assessment runs entirely in your browser and the answers are not sent anywhere. Exporting the result creates a file on your own device.
If you want a second set of eyes on the result, or want recovery runbooks for your ERP generated from your own documentation, Netray can review it with you. The assessment itself needs no contact.
Related Tools
Manufacturing Cyber Incident Response Plan Template
A fill-in incident response plan covering roles, severity levels, containment of IT and plant floor systems, communications and recovery, exportable as a document.
Compliance & ContractsCyber Insurance Readiness Checklist for Manufacturers
A checklist of the controls and documents underwriters commonly ask manufacturers about, so you can fix gaps before the application or renewal.
Industry TemplatesOT Asset Inventory Worksheet
An editable inventory of operational technology assets with Purdue level, firmware, support status and a criticality times exposure risk score.
Costing & FinanceCyber Insurance Coverage Limit Estimator
Estimate a defensible cyber insurance limit from annual revenue, outage length, contribution margin, response costs and restoration costs.
More Industry Templates tools
See all- OEE Improvement A3 Charter Template
- Customer Order Change Request Form Template
- Plant Network Segmentation Checklist (Purdue Model)
- Server Room UPS Runtime and Sizing Calculator
- Server Room Cooling Load BTU Calculator
- Ransomware Downtime Cost Calculator for Manufacturers
- Plant Switch Port Budget Worksheet
- Industrial Protocol and Plant IT TCP/UDP Ports Reference
- Plant Network VLAN and IP Addressing Plan Worksheet