There is no single certificate with a fixed total cost for manufacturing cyber security compliance. Cyber Essentials assessment fees depend on organisation size, while Cyber Essentials Plus costs depend on the size and complexity of the network. Preparation, remediation and consultancy can add to the budget.
The right scope also depends on customer and contract requirements, the systems supporting production and any product-specific obligations. Certification can provide evidence against a defined standard. It does not, by itself, assess every operational risk or guarantee that production can recover from an incident.
This article explains the difference between Cyber Essentials and Cyber Essentials Plus, the costs manufacturers should plan for and how requirements such as PSTI, UK GDPR and customer expectations may affect the work. It also considers supplier access, production downtime and practical ways to turn identified gaps into an improvement plan.
Key Takeaways
- Check what certification customers and contracts require before selecting an assessment.
- Distinguish Cyber Essentials assessment fees from Cyber Essentials Plus testing and the cost of preparing or remediating systems.
- Map how connected products, production systems, personal data and supplier access affect the scope of your security work.
- Check whether PSTI applies to products you manufacture rather than assuming it covers all industrial equipment.
- Treat compliance as an ongoing process that supports, but does not replace, operational resilience.
Certification Costs & Independent Testing
IASME’s published Cyber Essentials assessment fees are based on organisation size:
- 0 to 9 employees: £320 excluding VAT
- 10 to 49 employees: £440 excluding VAT
- 50 to 249 employees: £500 excluding VAT
- 250 or more employees: £600 excluding VAT
These fees apply to the Cyber Essentials assessment. They do not necessarily include consultancy, preparation or remediation. Cyber Essentials Plus does not have one fixed national price. Certification bodies quote for the technical assessment according to factors such as network size and complexity.
Check IASME’s current Cyber Essentials fees before setting a budget because certification prices and terms can change. Cyber Essentials Plus also requires the verified Cyber Essentials self-assessment as a prerequisite.
Cyber Essentials Plus adds independent technical testing to assess whether the scheme’s controls are working in practice. Budget separately for any work needed to address gaps and confirm what the certification body’s quote includes.
Manufacturers considering the higher-assurance option can review CyberOne’s guide to Cyber Essentials Plus certification costs before comparing preparation, assessment and remediation costs.
Before testing, define which systems and organisational boundaries are in scope. Manufacturers should clarify how corporate IT, production-support systems, supplier access and relevant cloud services are treated. Do not assume that certification automatically covers every factory-floor asset or operational technology risk.
A readiness review can compare relevant requirements with existing controls, collect evidence and assign owners to gaps. Prioritise remediation according to its potential effect on production, customer commitments and recovery.
Cyber Essentials focuses on five control areas:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
The UK Government recommends Cyber Essentials as a minimum cyber security standard for organisations of all sizes. The scheme is a certification option rather than a universal legal requirement. Its relevance depends on customer, contract and governance expectations. The NCSC’s Cyber Essentials overview explains the five controls, certification routes and differences between the two levels.
Cyber Essentials & Cyber Essentials Plus
Cyber Essentials and Cyber Essentials Plus assess the same five technical control areas. The difference is how the controls are assessed. Cyber Essentials uses a verified self-assessment, while Cyber Essentials Plus adds independent technical testing.
Cyber Essentials
Cyber Essentials gives manufacturers a structured way to review common weaknesses in the IT environment within the certification scope. Identify the systems covered and the people responsible for each control before starting the assessment. This helps organise evidence and makes ownership clearer.
Certification may support supplier assurance and contract discussions, but customer requirements vary. Check tender terms to see whether Cyber Essentials is requested, whether Cyber Essentials Plus is required or whether additional evidence is expected.
A certificate demonstrates alignment with the scheme’s defined scope. It does not prove that every production, operational technology or industrial control-system risk has been assessed.
Cyber Essentials Plus
Cyber Essentials Plus may be relevant when a customer, contract or internal assurance process calls for independent technical verification. Before commissioning the assessment, confirm the scope, testing method and what the quote includes.
For example, a manufacturer may need to explain how corporate IT connects to production-support systems and where supplier access fits. Record which systems are included and any exclusions. This helps customers and internal decision-makers understand what the certification does and does not cover.
Product Security Requirements for Connected Products
The Product Security and Telecommunications Infrastructure regime came into force on 29 April 2024. It applies to relevant consumer products that can connect to the internet or a network, not every connected industrial system or manufacturing asset. Manufacturers, importers and distributors may have obligations where an in-scope product is involved.
The core requirements include:
- Banning universal default and easily guessable passwords
- Publishing information on how security issues can be reported
- Publishing information on minimum security-update periods
The regime also includes duties concerning statements of compliance, record-keeping, investigating potential compliance failures and taking appropriate action. Manufacturers should review the UK’s consumer connectable product security regulations before including PSTI work in a compliance programme.
The official guidance lists exclusions, including medical devices, smart meter products and some categories of vehicles covered by other sector-specific requirements. Product teams should therefore assess the particular product, intended market and applicable exclusions rather than treating PSTI as a general manufacturing cyber security law.
Cyber Threats, Production Downtime & Recovery
A cyber incident can affect production as well as corporate IT. Disruption to production scheduling may delay work across several lines, while unavailable quality records can prevent finished goods from being released. Map operational dependencies alongside technical assets so decision-makers can understand potential effects on output, traceability and customer commitments.
Assess risks in the context of the processes each system supports. Consider how an unavailable warehouse management system could affect material movements or how losing machine configuration records could complicate maintenance. Include vulnerabilities in older equipment and the potential impact of a compromised supplier account without assuming every incident will affect the whole site.
The operational consequences of manufacturing incidents are explored further in CyberOne’s analysis of why manufacturers cannot afford complacency following the Jaguar Land Rover cyberattack.
Use scenarios to set recovery priorities. For each critical process, document:
- The accountable business owner
- Dependent systems and data
- Available manual workarounds
- Supplier dependencies
- Conditions for a safe restart
- Maximum tolerable disruption
- Escalation and decision authority
A practical recovery plan should identify who can authorise a production-system shutdown, which records must be restored or validated before restart and how teams will escalate issues. Test those decisions through exercises based on the site’s operations.
Record gaps such as unclear restart authority or missing system dependencies, then assign owners and review the plan when production processes or supplier arrangements change.
UK GDPR & Personal Data in Manufacturing
UK GDPR and Data Protection Act 2018 obligations are relevant when a manufacturer processes personal data. That may include information about employees, contractors, customers and visitors, such as payroll records, access-card logs, CCTV footage and customer support records.
The Information Commissioner’s Office states that organisations must process personal data securely through appropriate technical and organisational measures. What is appropriate depends on the organisation’s circumstances, the data being processed and the risks involved.
The ICO’s guidance on security outcomes groups these expectations around managing security risk, protecting personal data, detecting security events and minimising their impact.
Start by identifying where personal data is collected, stored or accessed across office, factory and cloud environments. Record the data type, business purpose, systems involved, access groups and external suppliers. Include production records where they can identify an individual rather than assuming factory data is never personal.
Review safeguards against the risks identified. Check that access is limited to work needs, administrator permissions are controlled and sensitive records are protected in storage and transit. For example, a supplier account used for equipment maintenance should not have unnecessary access to employee or customer records.
Incident handling should connect technical response with privacy assessment. If an incident may involve personal data, record which systems and information could be affected, who is assessing the impact and what decisions have been made. Security, privacy, legal and operational teams should know how to coordinate an investigation while limiting unnecessary disruption to production.
Assign owners for personal-data inventories and access reviews. Document supplier access to systems containing personal information and review safeguards when systems, suppliers or processing purposes change. Retain evidence of decisions and follow-up actions for governance reviews.
Standards Relevant to Manufacturers
ISO/IEC 27001 provides requirements for an information security management system. It supports an organisation-wide approach to identifying, managing and continually reviewing information security risk.
The IEC 62443 series addresses cyber security for industrial automation and control systems. It includes requirements and guidance relevant to asset owners, system integrators, service providers and product suppliers.
These standards address different needs. ISO/IEC 27001 focuses on an organisation’s information security management system, while IEC 62443 deals more directly with industrial automation and control-system security. Manufacturers should select standards according to their environment, contractual commitments and assurance requirements rather than treating them as interchangeable.
Manufacturers in specialist sectors may also face product or industry requirements. Automotive manufacturers, for example, may need to consider ISO/SAE 21434 for road-vehicle cyber security engineering.
Confirm the applicable standards, editions and certification expectations for the products and markets concerned. A customer may ask for certification, contractual control evidence or alignment without formal certification. These are different requirements with different costs.
Do the UK NIS Regulations Apply to Manufacturers?
Manufacturing is not a standalone sector under the current UK NIS Regulations. A manufacturer may still fall within scope because of another regulated activity or role. It may also face contractual requirements as a supplier to an in-scope organisation.
The Cyber Security and Resilience (Network and Information Systems) Bill proposes changes to the existing regime, including provisions affecting data centres, managed service providers and certain supply-chain organisations. However, it does not automatically bring every manufacturer into scope.
As of 6 November 2026, the Bill had completed its third reading in the House of Lords. Consideration of Lords amendments in the House of Commons was still listed with a date to be announced, so the Bill had not completed Parliament. Its provisions should not be presented as established legal requirements.
Manufacturers can monitor the Bill’s current parliamentary stages and review the House of Commons Library briefing for its proposed scope and changes to the NIS Regulations.
CyberOne’s strategic guide to the Cyber Security and Resilience Bill provides further business-focused context, but the parliamentary page should remain the source of truth for legislative status.
CyberOne Compliance & Security Support
CyberOne’s manufacturing and industrial cyber security services are designed around protecting intellectual property, production operations, supply chains and operational continuity. The current industry page identifies AssureMAP as a maturity-assessment and strategic-roadmap approach that benchmarks the organisation’s posture, identifies material risks and prioritises remediation.
A manufacturer can use this type of assessment to connect certification gaps with wider operational concerns. For example, an unsupported production server may affect a certification exercise, but its remediation priority should also reflect production dependency, replacement constraints and restart risk.
Where sensitive information needs stronger governance, CyberOne’s Microsoft Purview deployment service can include data discovery, classification, information protection, data loss prevention, retention design and phased deployment. The precise capabilities depend on licensing, supported workloads and the agreed engagement scope.
Where detection and response are priorities, CyberOne’s Managed Extended Detection and Response service may support monitoring and incident handling across a Microsoft security environment. The service should be scoped against the manufacturer’s critical systems, available telemetry, response authority and recovery requirements.
Contact CyberOne to discuss a practical assessment of your manufacturing environment.
Turn Compliance Priorities Into Sustained Progress
Manufacturing cyber security compliance is an ongoing operating discipline, not a one-off certification exercise. Assign accountable leads across security, operations and governance, then connect agreed priorities to investment and operational planning.
Review the plan when production processes, supplier relationships or technology change. If Microsoft Security is part of your environment, align its governance with the organisation’s security objectives and compliance requirements. This helps teams maintain oversight as the business evolves.
The practical objective is not to collect disconnected certificates. It is to build evidence that relevant controls are understood, implemented, tested and improved in ways that protect production and support customer confidence.
Frequently Asked Questions
What UK Cyber Security Regulations Apply to Manufacturers?
Requirements depend on the products manufactured, the organisation’s activities and whether it processes personal data.
PSTI applies to relevant consumer connectable products. UK GDPR applies where personal data is processed. The UK NIS Regulations may apply where a manufacturer carries out another regulated activity or role, while customer contracts can introduce further security expectations.
What Is PSTI & Does It Apply to Manufacturing Companies?
PSTI is the UK product-security regime for relevant consumer connectable products. Its requirements include restrictions on universal or easily guessable default passwords, a published route for reporting security issues and information about the minimum security-update period.
It does not apply to every connected industrial system. Manufacturers should check whether the specific product is covered and whether an exclusion applies.
Do the UK NIS Regulations Apply to Manufacturing Companies?
Manufacturing is not a standalone sector under the current UK NIS Regulations. A manufacturer may nevertheless be in scope because of another regulated activity or role or may have contractual obligations as a supplier to an in-scope organisation.
NIS2 is a separate EU framework and should not be assumed to apply to a UK manufacturer solely because it operates in manufacturing. It may be relevant where the organisation has qualifying operations in the EU.
The Cyber Security and Resilience Bill had not completed Parliament as of 6 November 2026. Check its current status and any resulting regulations before relying on its proposed provisions.
What Do Cyber Essentials & Cyber Essentials Plus Require?
Both assess five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
Cyber Essentials uses a verified self-assessment. Cyber Essentials Plus assesses the same controls through additional independent technical testing. Confirm the certification scope so you understand which systems and exclusions it covers.
How Much Do Cyber Essentials & Cyber Essentials Plus Cost?
Published Cyber Essentials assessment fees start at £320 excluding VAT and rise according to employee numbers. Cyber Essentials Plus is quoted by a certification body according to the size and complexity of the network.
Preparation, consultancy, testing support and remediation can add to the overall budget. Confirm the current fee schedule and quote inclusions before approval.
