IT & Microsoft cloud for manufacturing

The workable approach separates the estate rather than compromising across it. Office devices, servers and anything that can tolerate a maintenance window get a normal patch cadence with a defined 14-day target for critical updates. The machines that genuinely cannot be touched get compensating controls instead: strict network segmentation so they are unreachable from the general network, tightly controlled access, monitoring on the traffic in and out, and a documented reason why each one is treated as an exception. That distinction matters for certification too, because an auditor will accept a segmented, monitored exception with a migration plan far more readily than an estate where nothing is patched and nobody can say why.

Where the constraint is the application rather than the hardware, it is often more solvable than it looks. Capturing a line-of-business application from its running state and repackaging it for a supported operating system removes the dependency without needing the original install media, the source code or a supplier who may no longer exist.

For a manufacturer this tends to be uncomfortable in a specific way. The five Cyber Essentials controls, particularly the requirement that all software in scope is supported by its vendor and patched within 14 days for critical updates, sit awkwardly against exactly the aging OT-adjacent estate that keeps production running. This is where segmentation earns its keep: correctly scoped, the certification boundary can exclude genuinely isolated production systems and cover the business estate that handles customer data, which is what the customer asking the question actually cares about.

Getting the scope right is most of the work. Scope too widely and certification becomes impossible without replacing equipment nobody has budget for. Scope too narrowly or dishonestly and it fails at assessment, or worse, passes and gives false assurance.

The work is usually less disruptive than people fear because it happens around the production systems rather than to them. Defining the boundaries, putting controlled and monitored crossing points between zones, restricting which systems can talk to which, and logging what crosses can largely be done without reconfiguring the sensitive equipment itself. That matters when the equipment is validated, temperamental or supported by a third party who charges for every visit.

The measurable outcome is blast radius. A compromise on the office side becomes an office-side problem rather than a stopped line, and that difference is usually the gap between a bad week and a genuinely serious event.

We plan around planned downtime instead. Patching and maintenance follow each site's shift pattern rather than a uniform schedule, monitoring and alerting run continuously regardless of who is on site, and support hours are set against when people are actually working. Centrally managed device configuration through Intune keeps one policy set across every location, so a laptop in one plant is built and secured identically to one in another without anyone maintaining separate standards.

Multi-site also changes the cost conversation. Licences drift as sites are added, acquired or reorganised, and it is common to find production and warehouse staff carrying licence tiers built for knowledge workers. Right-sizing that across the group is usually one of the faster savings available.

Ranking them matters because recovery is sequential and resources are finite during an incident. If the ERP system comes back but the machine configurations do not, the line still cannot run. If quality records are unrecoverable, product may not be shippable even once production restarts, because the traceability chain is broken. Working out that order in advance, and how long the business can tolerate being without each one, is what turns a backup policy into a recovery plan.

Two things then have to be true rather than assumed. Backups must be immutable, so that ransomware which reaches the network cannot encrypt or delete the copies as well as the originals, which is now a standard part of how these attacks work. And restores must have been tested, because an untested backup is a belief rather than a control. We rehearse recovery for the systems that matter most rather than testing a single file restore and calling it proven.