Summary Points
-
The core barrier is fragmented accountability and funding—not a lack of policies. ICS/OT budgets are split across IT and OT at many organizations; only 27% of budget decisions are led by CISOs or CSOs.
-
Enterprise-wide standards mask uneven site-level security. Differences in asset age, visibility, remote access, staffing and local conditions leave some plants exposed despite apparent corporate compliance.
-
Production pressure and mismatched budget cycles delay fixes. Patching, segmentation and equipment replacement can wait for approvals or shutdown windows, leaving unmanaged assets and access paths in place.
- Closing the gap requires empowered joint IT/OT governance. Assign clear risk owners, align funding with plant schedules, use interim safeguards, and make security part of operational planning—not just written policy.
Underlying Problem
Industrial Cyber reports that manufacturing cybersecurity efforts are stalling less because of weak policies than because responsibility, funding, and authority are divided among headquarters, IT, operational technology (OT), and individual plants. As a result, security varies across sites: some have strong controls, while others retain unmanaged remote access, aging equipment, limited visibility, or untested recovery plans. Budget arrangements reflect the divide. The SANS 2025 survey found that control of ICS/OT funding is split between IT and OT at 37% of organizations; only 27% of budget decisions are led by security chiefs. Meanwhile, production schedules, local regulations, and separate approval cycles can delay work until a maintenance window—or leave it undone.
The people most affected are manufacturers, plant workers, and businesses that depend on reliable industrial operations. The consequences can include exposed systems, unauthorized access, production disruption, and risks to safety or the environment. Industrial Cyber draws on survey findings and interviews with cybersecurity executives ShangJyh Lin, Edward Liebig, Elizabeth McAndrew-Benavides, and Joseph Saunders. They describe unmanaged computers, unclear equipment ownership, and security projects delayed by competing priorities. Their central point is that written policies and spending alone cannot close these gaps. Instead, companies need clear joint IT/OT accountability, funding aligned with plant schedules, and leaders empowered to weigh security against operational risk.
What’s at Stake?
This issue can affect any business, not just manufacturers. Security ownership may be unclear, budgets may not match the risk, and operational teams may prioritize uptime or delivery over protective controls. As a result, known weaknesses go unaddressed, monitoring remains incomplete, and incident plans may fail when tested. A breach can then halt production or services, expose customer and employee data, disrupt suppliers, and trigger recovery costs, regulatory penalties, or lost contracts. Moreover, even a short outage can damage trust and revenue. Clear accountability, sustained funding, and security practices aligned with daily operations are therefore essential.
Possible Actions
When accountability, funding, and production priorities diverge, timely remediation can prevent governance gaps from becoming operational disruptions.
Governance Remediation
- Assign named executives and operational owners to cybersecurity risks, with clear decision rights and escalation paths.
- Establish a cross-functional governance group spanning security, plant operations, engineering, finance, and leadership.
- Tie cybersecurity funding to documented risk, business impact, and recovery needs; review resource gaps regularly.
- Set risk-based remediation deadlines, prioritizing safety, production-critical systems, and exposed or actively exploited vulnerabilities.
- Track exceptions through formal approval, compensating controls, accountable owners, and expiration dates.
- Integrate cybersecurity requirements into operational change management, procurement, and maintenance planning.
- Measure progress with agreed indicators—such as overdue high-risk findings, exception age, and remediation completion—and report them to leadership.
- Reassess governance and controls after incidents, major operational changes, and scheduled risk reviews, consistent with the NIST Cybersecurity Framework.
Continue Your Cyber Journey
Discover cutting-edge developments in Emerging Tech and industry Insights.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
