Product Overview

Summary: This SOP establishes a clear, practical framework for integrating cybersecurity controls into your production processes, systems and equipment. It helps Australian businesses protect operational technology (OT) and manufacturing environments from cyber threats that can halt production, compromise product quality or expose sensitive data.

Modern production environments rely heavily on interconnected systems, from PLCs and SCADA through to cloud-based monitoring platforms and supplier portals. This dependence on digital technology exposes factories, processing plants and other production facilities to cyber risks that can stop lines, corrupt recipes, alter safety limits or leak commercially sensitive information. The Cybersecurity in Production Processes SOP provides a structured, step-by-step approach to identifying critical assets, hardening control systems and managing access so that cyber incidents are far less likely to disrupt operations or compromise product integrity.

Tailored for Australian businesses, this document bridges the traditional gap between IT security and production operations. It sets out how to embed cybersecurity into day-to-day production planning, change management, maintenance activities and contractor management, without overburdening frontline teams. By following this SOP, organisations can demonstrate due diligence to regulators, insurers and major clients, while building a resilient production environment that can withstand common cyber threats such as ransomware, unauthorised remote access and malicious configuration changes.

The SOP also supports integrated risk management by aligning cybersecurity practices with existing WHS, quality and business continuity frameworks. It outlines clear responsibilities for production, IT, OT and management personnel, provides practical guidance on incident response in a live production environment, and helps ensure that system updates, new equipment and process changes are introduced in a controlled, secure and auditable manner.

Key Benefits

• Reduce the risk of production downtime and product loss caused by cyber incidents targeting control systems and production networks.
• Strengthen protection of operational technology (OT) assets, including PLCs, SCADA, HMIs and networked machinery, through consistent security controls.
• Ensure clear roles, responsibilities and escalation pathways between production, IT and management teams during planning, operation and incident response.
• Streamline onboarding and oversight of contractors, integrators and vendors who access production systems, reducing third‑party cyber risk.
• Demonstrate due diligence to regulators, customers and insurers through documented, repeatable cybersecurity practices embedded in production processes.

Who is this for?

• Operations Managers
• Production Managers
• Manufacturing Engineers
• IT Managers
• OT/Industrial Control Systems (ICS) Engineers
• WHS and Risk Managers
• Quality Assurance Managers
• Maintenance Supervisors
• Information Security Managers
• Business Continuity and Resilience Managers

Included Sections

• 1.0 Purpose, Scope and Objectives
• 2.0 Definitions and Abbreviations (IT, OT, ICS, SCADA, PLC, etc.)
• 3.0 Roles and Responsibilities (Production, IT, OT, WHS, Management)
• 4.0 Applicable Legislation, Standards and Company Policies
• 5.0 Cyber Risk Assessment for Production Processes
• 6.0 Identification and Classification of Critical Production Assets
• 7.0 Network Segmentation and Access Control for Production Systems
• 8.0 Secure Configuration of Control Systems and Production Equipment
• 9.0 User Account Management and Privileged Access in Production Environments
• 10.0 Remote Access, Vendor Support and Contractor Management
• 11.0 Patch Management, Updates and Change Control for Production Systems
• 12.0 Data Backup, Recovery and System Redundancy for Production Operations
• 13.0 Monitoring, Logging and Anomaly Detection in Production Networks
• 14.0 Cyber Incident Response Procedures for Production Environments
• 15.0 Integration with WHS, Quality and Business Continuity Plans
• 16.0 Training, Awareness and Competency Requirements
• 17.0 Document Control, Review and Continuous Improvement

Legislation & References

• AS ISO/IEC 27001:2023 Information security, cybersecurity and privacy protection – Information security management systems
• AS ISO/IEC 27002:2023 Information security, cybersecurity and privacy protection – Information security controls
• AS ISO 22301:2021 Security and resilience – Business continuity management systems
• Australian Cyber Security Centre (ACSC) Essential Eight Maturity Model
• AS/NZS ISO 31000:2018 Risk management – Guidelines
• Security of Critical Infrastructure Act 2018 (Cth) – where applicable to critical infrastructure sectors
• Work Health and Safety Act 2011 (Cth/model) – duty to manage risks associated with plant and systems of work (as they intersect with cyber‑physical risks)