Product Overview

Summary: This SOP sets out a clear, practical framework for protecting manufacturing systems, production networks, and operational technology from cyber threats. It helps Australian manufacturers safeguard uptime, intellectual property, and safety-critical control systems by embedding consistent cybersecurity practices across the plant.

Modern manufacturing facilities increasingly rely on interconnected systems, from SCADA and PLCs to IoT sensors and cloud-based production planning tools. This connectivity brings efficiency and real-time visibility, but it also introduces new cyber risks that can halt production, corrupt product quality, or compromise safety-critical controls. The Cybersecurity for Manufacturing Systems SOP provides a structured, repeatable approach to managing these risks in line with Australian expectations for due diligence and WHS obligations relating to plant and systems of work.

The document translates technical cybersecurity concepts into practical steps that operations, maintenance and IT teams can follow on the factory floor. It covers secure access to control systems, network segmentation between office IT and shop-floor OT, patch and change management, backup and recovery, incident reporting, and coordination with external vendors and service providers. By implementing this SOP, manufacturers gain a clear line of sight over who can access their systems, how changes are controlled, and what to do if a cyber incident impacts production or safety. It supports business continuity, protects sensitive design and production data, and helps demonstrate that the organisation has taken reasonable steps to manage cyber risks to plant and workers.

Key Benefits

• Reduce the likelihood of cyber incidents disrupting production, damaging equipment, or corrupting product quality.
• Ensure consistent, auditable cybersecurity practices across IT and OT environments in line with Australian regulatory expectations.
• Strengthen control over remote access, vendor connections, and engineering workstations used to configure PLCs and SCADA systems.
• Streamline incident detection, reporting, and response so that cyber events are contained quickly and communicated clearly.
• Protect intellectual property, recipes, and customer data associated with manufacturing processes and supply chains.

Who is this for?

• Operations Managers
• Plant Managers
• IT Managers
• OT (Operational Technology) Engineers
• Maintenance Supervisors
• WHS Managers
• Production Supervisors
• Industrial Control Systems (ICS) Specialists
• Quality and Compliance Managers
• Business Owners and Directors in Manufacturing

Included Sections

• 1.0 Purpose, Scope and Objectives
• 2.0 Definitions and Abbreviations (IT, OT, ICS, SCADA, PLC, etc.)
• 3.0 Roles and Responsibilities (Management, IT, OT, Contractors)
• 4.0 Applicable Legislation, Standards and Company Policies
• 5.0 Cyber Risk Assessment for Manufacturing Systems
• 6.0 Asset Inventory and Classification (Systems, Devices, Software)
• 7.0 Network Architecture and Segmentation Requirements
• 8.0 Access Control and User Management for OT and IT Systems
• 9.0 Remote Access, Vendor Connections and Third-Party Integrations
• 10.0 Secure Configuration and Hardening of PLCs, SCADA and HMIs
• 11.0 Patch Management and Change Control for Production Systems
• 12.0 Malware Protection, Application Whitelisting and USB/Media Controls
• 13.0 Data Backup, Recovery and Business Continuity for Manufacturing Operations
• 14.0 Monitoring, Logging and Alerting for Cyber Events
• 15.0 Cybersecurity Incident Response and Escalation Procedures
• 16.0 Coordination with WHS and Emergency Management for Safety-Related Incidents
• 17.0 Training, Awareness and Competency Requirements
• 18.0 Documentation, Recordkeeping and Audit Trail
• 19.0 Review, Continuous Improvement and SOP Revision History

Legislation & References

• AS ISO/IEC 27001: Information security management systems
• AS ISO/IEC 27002: Information security controls
• AS ISO/IEC 62443 series: Industrial communication networks – Network and system security (industrial automation and control systems)
• Security of Critical Infrastructure Act 2018 (Cth) – for applicable critical manufacturing sectors
• Work Health and Safety Act 2011 (Cth/model) – duties relating to safe systems of work and plant
• Work Health and Safety Regulations 2011 – management of risks associated with plant and systems of work
• Australian Cyber Security Centre (ACSC) Essential Eight Maturity Model – hardening and resilience guidance