Imagine a plant manager arriving on a Monday morning to find the production lines physically ready to run. The machines work, the raw materials are on the racks, and the crew is on the floor.
The problem is that nobody can say which orders are due, what stock is actually available, or which jobs were half-finished when the systems went dark over the weekend.
This is a common picture of a cyber incident in manufacturing. The attack may target IT systems, but the damage spreads into scheduling, purchasing, and shipping because the business loses its view of its own operations.
When Norsk Hydro was hit by ransomware in 2019, several of its plants switched to manual operations while systems were restored. More recently, the 2025 attack on Jaguar Land Rover halted production for weeks.
This article looks at manufacturing cyber resilience from an operations perspective: why reliable records of inventory, orders, and production status often determine how quickly and safely a plant gets back to work.
What Is Manufacturing Cyber Resilience and Why Does Recovery Depend on It?
Cyber resilience is an organization’s ability to anticipate, withstand, recover from, and adapt to cyber incidents while keeping essential operations going. Cybersecurity focuses on keeping attackers out.
Resilience assumes that something may eventually get through and asks how the business keeps functioning anyway.
For manufacturers, recovery has two layers. The first is technical: cleaning infected machines, restoring backups, and confirming systems are safe.
The second is operational: working out what was in progress, what was shipped, and what the business owes its customers and suppliers.
Security teams usually handle the first layer. Operations teams are left to handle the second, often with far less preparation.
Why Does Operational Data Visibility Matter Most During Cyber Recovery?
Restored servers do not tell you what happened on the shop floor during the outage. If backups are a day old, the system may show raw material that was already consumed or orders that were already shipped by hand.
Operational data visibility means having a trustworthy, current view of inventory, work orders, purchase orders, and sales commitments. During recovery, that view answers the questions leadership asks first:
- Which customer orders are at risk?
- What can we produce with the stock we physically have?
- Which purchase orders are open, and what has already arrived?
Without clear answers, teams make decisions based on memory and guesswork. That can lead to duplicate orders, missed shipments, and production runs built on incorrect stock figures.
How Do Disconnected Manufacturing Systems Complicate Cyber Incident Response?
Many manufacturers run their operations across a mix of tools: accounting software, spreadsheets for inventory, a separate scheduling file, and email threads with suppliers.
Each tool works well enough day to day. During an incident, the gaps become a serious problem.
Responders have to restore and check each source separately. Spreadsheets saved on a shared drive may be encrypted alongside everything else.
Even when files survive, they often disagree with each other, and nobody is sure which version reflects reality.
Disconnected systems also make it harder to know what “normal” looked like before the attack. If inventory numbers lived in three places, it becomes difficult to judge whether restored data is complete or whether something was altered.
What Operational Data Do Manufacturers Lose Visibility Into During an Attack?
| Data Area | What Goes Missing | Recovery Impact |
| Inventory levels | Stock on hand, locations, reserved quantities | Risk of promising stock you don’t have |
| Work orders | Job status, completed steps, material consumed | Partially built goods may be lost or reworked |
| Bills of materials | Component lists and quantities | Production planning stalls |
| Purchase orders | Open orders, received goods, supplier terms | Duplicate or missed purchasing |
| Sales orders | Due dates, customer commitments | Missed shipments and strained customer relationships |
| Lot and batch records | Traceability of materials to finished goods | Compliance and recall exposure |
Traceability deserves special attention. For food, medical, and other regulated manufacturers, gaps in lot records can create problems long after systems come back online.
How Does Manufacturing Software Help Maintain Reliable Operational Records During Cyber Disruptions?
Software alone does not make a business resilient. What helps is keeping operational records in one consistent system rather than scattered across files, so there is a single source to restore and verify.
When inventory, production, purchasing, and sales share the same data, a stock movement updates everywhere at once. During recovery, teams can compare one set of records against physical counts instead of reconciling several conflicting ones.
A cloud-based operations management software such as Sutton is one example of this approach, bringing inventory, production, purchasing, and sales together for manufacturers and distributors.
There are trade-offs. Centralizing data requires clean setup, accurate opening balances, and staff who record transactions consistently.
Cloud hosting also means your recovery partly depends on the vendor’s security and backup practices, so it is worth asking providers how they handle these.
A connected system supports recovery; it does not replace backups, access controls, or an incident response plan.
How to Build an Operational Data Visibility Layer That Speeds Recovery
A few practical steps make a noticeable difference, regardless of which tools you use:
- Identify your critical records. Decide which data you need to restart production and ship orders within the first few days.
- Reduce the number of sources. Every extra spreadsheet is one more thing to restore and reconcile.
- Keep printable fallbacks. Regularly export open orders, stock levels, and schedules so the team can work manually if needed.
- Practice cycle counting. Plants with routine counts can confirm restored inventory far faster than those relying on annual stocktakes.
- Include operations in incident drills. Tabletop exercises should cover how the warehouse and production teams will work, not only how IT restores servers.
Which Recovery Metrics (RTO, RPO, MTTR, MTCR) Should Manufacturers Track?
| Metric | What It Measures | Operational Question It Answers |
| RTO (Recovery Time Objective) | Maximum acceptable downtime for a system | How long can we go without order or inventory data? |
| RPO (Recovery Point Objective) | Maximum acceptable data loss, measured in time | How many hours of transactions can we afford to re-enter? |
| MTTR (Mean Time to Recover) | Average time to restore service after an incident | How long do outages actually last for us? |
| MTCR (Mean Time to Clean Recovery) | Time to return to operation from a verified, malware-free state | How long until we can trust the restored data? |
For manufacturers, RPO is often underestimated. A 24-hour RPO might sound acceptable until you realize it means re-entering a full day of receipts, production completions, and shipments. Set these targets based on business impact, not general benchmarks.
How to Restore Production Safely After a Cyberattack
Rushing back to full output can cause more harm than a short delay. A sensible sequence looks like this:
- Confirm with your security team or partner that systems are clean before reconnecting them.
- Restore core records, then compare them with physical inventory counts in priority areas.
- Re-enter transactions that happened manually during the outage, using paper records collected at the time.
- Restart production with high-priority orders first, and verify bills of materials before releasing work orders.
- Review what slowed recovery and update procedures accordingly.
Human judgment remains central throughout. Systems can show what the records say, but supervisors and warehouse staff are the ones who confirm whether those records match the floor.
Frequently Asked Questions
Is cyber resilience only an IT responsibility?
No. IT restores systems, but operations teams determine whether the business can actually produce and ship. Both need defined roles in the recovery plan.
Do all manufacturers need an ERP or MRP system to be resilient?
Not necessarily. Resilience depends on reliable records, tested backups, and practiced procedures. Some businesses manage this with simpler tools, while others benefit from a connected system as operations grow more complex.
Does cloud software protect against ransomware?
It can reduce exposure for data stored on local machines, but it is not immunity. Strong passwords, multi-factor authentication, and understanding your vendor’s backup practices still matter.
How often should recovery plans be tested?
At least once a year is a reasonable starting point, with more frequent checks for critical systems or after major process changes.
