The DBIR's fastest-growing breach category, and the sector with the clearest new rules for defense suppliers. Sophos sized for plants in Canada and the United States. Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States. Three questions every manufacturing owner asks. Tap a card to jump to the detail. Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research. ERP, MES and file servers go down, and production stops even if the PLCs are untouched. Manufacturing made up the largest share (16%) of the incident response and MDR cases in Sophos's 2025 Active Adversary Report. Source Rules and standards What fixes it Legacy machines and SCADA run software that cannot be updated without stopping production. Exploited vulnerabilities started 32% of ransomware attacks on manufacturers. Source Rules and standards What fixes it Designs, bids and CUI are stolen before encryption, or uploaded to the wrong place. 39% of manufacturers with encrypted data also had data stolen. Source Rules and standards Machine builders and integrators keep remote-support tunnels open for years. A third party was involved in 61% of manufacturing breaches. Source Rules and standards Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records. What breach and ransomware research says about this sector. Every figure links to its source. 3,627 incidents and 2,713 confirmed breaches in manufacturing, Verizon 2026 DBIR manufacturing snapshot. Sophos surveyed 332 manufacturing and production IT and security leaders in 17 countries whose organizations were hit by ransomware. Source: Sophos The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain. The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date. What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again. for a US defense contractor to report a cyber incident to the Department of Defense (DFARS 252.204-7012) A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key. Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection Every laptop, desktop and server runs protection that blocks and rolls back ransomware. Covered by: Sophos Endpoint and Endpoint for Server; MDR watches it 24/7 Machines, sensors and control systems sit on their own network with tightly limited connections to the office. Covered by: Sophos Firewall, Sophos Switch, Sophos NDR Systems log sign-ins and changes, and the logs are kept long enough to investigate. Covered by: Sophos Next-Gen SIEM, Sophos XDR A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline. Covered by: Sophos MDR Plus responds 24/7 and documents the incident A risk assessment and regular scans, with the most dangerous gaps fixed first. Covered by: Sophos Managed Risk, TrendAI Vision One CREM Regular training so people recognize phishing, fake invoices and impersonation. Covered by: Sophos Email catches most lures; a staff training program covers the rest Copies of your data that an attacker cannot delete, and a restore you have actually tested. Covered by: N-able Cove, Axcient x360Recover and x360Cloud The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them. Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the manufacturing rule each row helps with. Decide who is responsible, which rules apply and what is allowed. List what you have and find the gaps before attackers do. Firewall, email and device protection, safe logins and remote access. Watch accounts, networks and logs for signs of an attack. Contain an attack fast, work out what happened, and tell the people who need to know. Backups you have tested, so you can restore instead of paying. The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records. All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence. Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request. Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation. Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud. The list follows Marsh's twelve key cyber controls. Source Where insurers dig deeper: Manufacturers are asked about end-of-life systems on the plant floor, separation between plant and office networks, and how long production can stop before losses mount. A head office attached to the main plant, a second plant, about 220 staff and an on-premises ERP would typically run: Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency. Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days. Available in Canada and the USA. Sophos Silver Partner. The main ones on this page are listed by country. In the United States: CMMC 2.0 (32 CFR and 48 CFR). In Canada: Canadian Program for Cyber Security Certification (CPCSC). In Both: NIST SP 800-171 and CSF 2.0, Customer and insurer questionnaires. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates. Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor. The Verizon 2026 DBIR manufacturing snapshot puts exploited vulnerabilities at 38% of breaches, ahead of phishing at 13%. Plants run long-lived systems and remote-access tools that are hard to patch, which is what attackers scan for. Sophos Managed Risk finds that exposure and the XGS firewall's IPS blocks known exploits while patches are scheduled. No product does. Level 2 is the NIST SP 800-171 control set, and it is assessed against your whole environment and your documentation. Sophos provides the technical controls for many of the requirements, including endpoint protection, network segmentation, MFA-related identity monitoring, logging and incident response, and Nuformat maps them to the control numbers. The Canadian Program for Cyber Security Certification, Canada's counterpart to CMMC for defense suppliers. Level 1 applies to select contracts from summer 2026, with Levels 2 and 3 to follow, harmonized with US requirements. Put them in their own zone behind the Sophos XGS firewall with only the traffic they need, watch the zone with a Sophos NDR sensor, and give integrators ZTNA access to specific machines rather than a VPN into the plant. Yes. Nuformat is a Sophos Silver Partner with offices in Ontario and Texas, quoting in CAD and USD. It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.Cybersecurity for manufacturers and plant floors.
The page in 30 seconds
See the top risks →
See what they ask for →
See the feature match →1. The problem: your top 4 risks, the rule behind each, and what fixes it
1Ransomware that stops the line
2Old control systems you cannot patch
3Drawings and controlled data leaking out
4Suppliers and integrators with remote access
The risk in numbers
If ransomware hits a manufacturer
How an attack unfolds here, and where Sophos stops it
What you have to comply with
Where Rule or expectation What it asks for United States CMMC 2.0 (32 CFR and 48 CFR) Phase 1 self-assessments for new DoD solicitations began November 2025. Level 2 is NIST SP 800-171. Third-party assessment timing (Phase 2) was placed under DoD review in July 2026; check the current status before bidding. Source Canada Canadian Program for Cyber Security Certification (CPCSC) Level 1 certification applies to select defense contracts from summer 2026, with Levels 2 and 3 to follow, harmonized with US requirements. Source Both NIST SP 800-171 and CSF 2.0 The control set behind CMMC Level 2 and the framework customers and insurers use to assess a plant. Source Both Customer and insurer questionnaires OEM customers require MFA, endpoint detection, segmentation and incident response from suppliers. Source 2. The rules, in plain English
1Lock every login with a second step
2Stop malware and ransomware on every computer
3Keep plant and control systems apart
4Keep a record of who did what
5Have a plan, and report on time
6Find and fix weak spots on a schedule
7Teach staff to spot scams
8Back up, and prove you can restore
Feature match: what you need, and who covers it
How the pieces fit together
Set the rules
Know your weak spots
Keep attackers out
Spot what gets through
Stop it fast
Get back to work
What you need Sophos TrendAI Backup: N-able Cove or Axcient 1Password Helps meet
ProtectSophos Firewall (XGS) TrendAI Network Security (intrusion prevention, used alongside a firewall) – – NIST 800-171 3.13 System and communications protection; IEC 62443 FR5
ProtectSophos Endpoint
Sophos Endpoint for ServerTrendAI Endpoint Security – – NIST 800-171 3.14 System and information integrity
ProtectSophos Email TrendAI Email and Collaboration Security – – NIST 800-171 3.14.2 malicious code protection; 3.14.6 monitoring
Detect and RespondSophos MDR TrendAI MDR – – NIST 800-171 3.6 Incident response; IEC 62443 FR6
Protect and DetectSophos ITDR TrendAI Identity Security – 1Password Business NIST 800-171 3.1 Access control and 3.5 Identification and authentication; NIST SP 800-171 Rev. 2, 3.5.7 and 3.5.8 password complexity and reuse
DetectSophos NDR TrendAI XDR for Networks (NDR) – – IEC 62443 FR6; NIST 800-171 3.14.6-3.14.7 monitoring
ProtectSophos Workspace Protection (ZTNA) TrendAI ZTSA Private Access – – NIST 800-171 3.1.12 remote access; IEC 62443 FR2
IdentifySophos Managed Risk TrendAI Cyber Risk Exposure Management – – NIST 800-171 3.11 Risk assessment; 3.12
Protect and DetectSophos Next-Gen SIEM TrendAI Agentic SIEM – – NIST 800-171 3.3 Audit and accountability
Protect and Recover– – N-able Cove for Microsoft 365
Axcient x360Cloud– NIST 800-171 3.8.9 protect backup CUI; CSF RC.RP
Protect and Recover– – N-able Cove for PCs, Macs and servers
Axcient x360Recover– NIST 800-171 3.8.9; IEC 62443 FR7
Protect– – Axcient x360Sync – NIST 800-171 3.1.3 control the flow of CUI
Govern and ProtectSophos AI Defense TrendAI ZTSA AI Service Access – – NIST 800-171 3.1.3 flow of CUI; NIST AI RMF
ProtectSophos Mobile TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them. – – NIST 800-171 3.1.18-3.1.19 mobile devices Every Sophos product line, mapped to manufacturing (17 lines)
Sophos product line Use in manufacturing Helps meet Sophos Firewall (XGS)Protect Separates the plant floor from IT; IPS and SD-WAN between plants. NIST 800-171 3.13 System and communications protection; IEC 62443 FR5 Sophos Virtual FirewallProtect Protects ERP and MES systems hosted in the cloud. NIST 800-171 3.13 Webserver Protection add-onProtect Protects supplier and customer portals. NIST 800-171 3.13 and 3.14 Sophos SwitchProtect Segmented switching for production cells and office networks. NIST 800-171 3.13; IEC 62443 FR5 Sophos AP6 wirelessProtect Plant Wi-Fi for scanners and AGVs, separate from guests. NIST 800-171 3.1.16-3.1.17 wireless access Sophos EndpointProtect Protects engineering workstations and office PCs. NIST 800-171 3.14 System and information integrity Sophos Endpoint for ServerProtect Protects ERP, MES and CAD file servers holding CUI. NIST 800-171 3.14 System and information integrity Sophos XDRDetect Investigation across endpoint, email and firewall. NIST 800-171 3.3 Audit and accountability; 3.6 Sophos MDR and MDR PlusRespond 24/7 response so a ransomware hit does not stop the line. NIST 800-171 3.6 Incident response; IEC 62443 FR6 Sophos ITDRDetect, Respond MFA and least privilege for CUI systems. NIST 800-171 3.1 Access control and 3.5 Identification and authentication Sophos NDRDetect Watches PLCs and OT devices that cannot run an agent. IEC 62443 FR6; NIST 800-171 3.14.6-3.14.7 monitoring Sophos EmailProtect Stops supplier fraud and phishing aimed at buyers. NIST 800-171 3.14.2 malicious code protection; 3.14.6 monitoring Sophos Next-Gen SIEMDetect The audit log retention CMMC and CPCSC assessors ask for. NIST 800-171 3.3 Audit and accountability Sophos Managed RiskIdentify Scheduled vulnerability findings and risk trends. NIST 800-171 3.11 Risk assessment; 3.12 Sophos Workspace Protection (ZTNA)Protect Vendor and remote engineer access to one system only. NIST 800-171 3.1.12 remote access; IEC 62443 FR2 Sophos MobileProtect Manages phones and tablets that access CUI. NIST 800-171 3.1.18-3.1.19 mobile devices Sophos AI Defense Quote on requestGovern, Protect Stops drawings and CUI being uploaded to AI tools. NIST 800-171 3.1.3 flow of CUI; NIST AI RMF Cyber insurance: what it pays for and what insurers check
Your own costs
Claims against you
The 12 controls insurers look for
A worked example: a manufacturer with two plants
Where What runs there Main plant and ERP XGS 3300 HA pair with Xstream, Sophos Endpoint, MDR Plus, Next-Gen SIEM Second plant XGS 2300 with Xstream, SD-WAN to the main plant Plant floor at both sites OT zone behind the firewall, NDR sensor on each Integrators and vendors Sophos ZTNA, per system Exposure Managed Risk scanning the external footprint; Cove backup with a tested restore Get this sized and quoted for your organization
Frequently asked questions
Which cybersecurity rules and frameworks apply to manufacturing?
Which products cover the main cybersecurity needs for manufacturing?
Why is manufacturing breached through vulnerabilities more than other sectors?
Does Sophos make us CMMC Level 2 compliant?
What is CPCSC?
How do we protect PLCs and CNC machines that cannot run security software?
Do you serve plants in both countries?
Will Sophos help us get or renew cyber insurance?
Industries · Manufacturing · Canada and USA
In plain terms: Manufacturers are breached through unpatched systems more than anyone else, and the payload is ransomware that stops the line. Add CMMC in the US and CPCSC in Canada for anyone in a defense supply chain, and the plant floor now needs the same evidence as the office.
1The problem
2The rules
3The fix
NIST 800-171 3.6 Incident responseIEC 62443 FR7
IEC 62443 FR5 restricted data flowNIST 800-171 3.13
NIST 800-171 3.1.3 flow of CUICMMC and CPCSC
NIST 800-171 3.1.12 remote accessIEC 62443 FR2
61%
of manufacturing breaches involved ransomware
Verizon 2026 DBIR
38%
began with an exploited vulnerability, ahead of phishing at 13%
Verizon 2026 DBIR
61%
involved a third party such as a supplier, integrator or MSP
Verizon 2026 DBIR
15%
of breaches were espionage-motivated, alongside 87% financial
Verizon 2026 DBIR
Most common way in32%Exploited vulnerabilitiesthe most common way in
What it costs$1Mmedian ransom paid
And then$1.3Maverage cost to recover, ransom not included
1Entry
What happensUnpatched edge device or an integrator's remote tool
What stops itXGS firewall with IPS; Managed Risk finds the exposure; ZTNA for vendors
2Foothold
What happensAn engineering workstation or ERP server
What stops itSophos Endpoint stops exploits and ransomware behavior
3Spread
What happensToward MES, historians and the plant network
What stops itFirewall zones between IT and OT; NDR sensor on the plant segment
4Impact
What happensProduction halt, design theft
What stops itMDR Plus responds 24/7; Cove restores; SIEM keeps CMMC evidence
72hours
NIST 800-171CMMC
NIST 800-171
IEC 62443Customers
NIST 800-171
DFARS 7012NIST 800-171
NIST 800-171
NIST 800-171
Insurers
Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.
Govern
Sophos AI Defense
Identify
Sophos Managed Risk
Protect
Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile
Detect
Sophos NDRSophos ITDRSophos Next-Gen SIEM
Respond
Sophos MDR
Recover
N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall.
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted.
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation.
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends.
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password.
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own.
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network.
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first.
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when.
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data.
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure.
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives.
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved.
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost.
Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.
1
MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection
2
Email filtering and web securitySophos Email; Sophos Firewall web filtering
3
Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud
4
Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials
5
Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR
6
Patch and vulnerability managementSophos Managed Risk; TrendAI CREM
7
Incident response planSophos MDR Plus includes incident response
8
Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume
9
Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP
10
Logging and monitoringSophos Next-Gen SIEM; MDR
11
Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched
12
Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts
Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source
Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.
Sources