Quarterly Manufacturing Plant Hardening

Every 90 days, with a trend line on every check.

What it is

Runs twenty-three checks on this office computer, the network it is on, the production devices it can hear and the domains you declare, asks your plant's questions once, and maps everything to the NIST Cybersecurity Framework Manufacturing Profile in one report. Nothing is changed.

Ransomware stops the line, and a customer's supplier questionnaire or your insurer asks whether the office and the floor share one network, who reaches the machines from outside, and what still runs on old Windows. This bundle gathers what one plant can show: its office computers, the devices sharing its network, the doors designs could leave through, your domain, and your own answers.

This is the quarterly form of the Manufacturing Plant Hardening Bundle (IND-MFG-85): the same 23 checks, run four times a year, each report showing what changed since the last.

The framework

Mapped to the NIST CSF Manufacturing Profile — with IEC 62443 by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.

Who it is for

A small to mid-size plant or machine shop with its own office computers and a production floor; a defence supplier is cross-sold the Defense Contractor Readiness Bundle. A multi-plant manufacturer is measured across every plant and production network and is the human-delivered engagement's customer; this bundle is one plant's first look.

A multi-plant manufacturer is measured across every plant, every production network and every automation vendor's access, with zones and conduits drawn for the whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer and the network it ran on and is a useful first look for the plant manager who ran it.

What runs (23 checks)

• Windows Security Health Check (ENDPOINT-01)
• Ransomware Readiness Check (RANSOM-READY-03)
• Account & Access Review (INSIDER-ACCESS-05)
• Credential Hygiene Check (PW-HYGIENE-11)
• Out-of-Date Software Scan (EOL-16)
• Startup & Persistence Check (PERSIST-24)
• Wi-Fi & Home Network Check (WIFI-LAN-02)
• Router & Wi-Fi Settings Checklist (ROUTER-22)
• Email Spoofing & BEC Check (BEC-08)
• Breach & Identity Exposure Check (BREACH-10)
• Insider Risk Self-Assessment (INSIDER-21)
• Industry Readiness Questionnaire (READINESS-91)
• Internet Exposure Scan (EXPOSURE-06)
• Website & Storefront Checkup (STOREFRONT-07)
• Certificate & Encryption Check (TLS-09)
• Domain & DNS Security Check (DNS-63)
• Medical & Operational Device Scan (DEVICES-77)
• Removable Media & Cloud Sync Check (DATAEXIT-76)
• Workstation Policy & Logging Check (POLICY-79)
• Hardware, Firmware & Removable-Media Check (ASSET-73)
• Digital Asset Register & Ownership Check (REGISTER-74)
• AI Usage & Shadow-AI Exposure Review (AIUSE-70)
• Active Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)

Offered separately, never run by this package: Linux Server Hardening Check (SERVER-25): a Linux product the Windows package engine cannot run on this computer; the report offers it.

Before it runs: one question you can say no to

• May the Removable Media & Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.

Price

$699 a year, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is $549: the Manufacturing Plant Hardening Bundle (IND-MFG-85).

What it never does

It never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.