A small manufacturer can cover the most important ground in 30 days: week one find and close internet exposure, week two inventory and change default passwords, week three control remote access and draw the IT and OT boundary, week four rehearse manual operation. This follows CISA's primary mitigations.
Before you start
Pick an owner on the operations side and one from IT, and agree that production safety is not negotiable. Tell leadership what will be touched and when. You do not need new products to begin, only time and access to people who know the equipment.
Week 1: find and close exposure
- Gather public IP ranges and search for industrial devices from outside, with permission for your own ranges.
- Review firewall port forwards and remove any that expose controllers, HMIs or remote desktop.
- Confirm cellular modems and vendor links are on a list.
CISA lists removing OT connections to the public internet first among its five primary mitigations.
Week 2: inventory and passwords
- Walk the floor and list controllers, HMIs, switches, engineering laptops and remote access devices. CISA's inventory guidance treats protocols, criticality, role, IP and MAC address, manufacturer, model, operating system, location, ports and user accounts as high priority fields.
- Mark which assets are most critical to production and safety.
- Change default passwords where you can, starting with anything reachable from outside. Note any you cannot change.
- Take a backup of each controller's logic and store it off the device.
Week 3: remote access and boundary
- List every remote access path. Remove the unjustified ones.
- Require MFA and named accounts for the remaining ones, and prefer a gateway or jump host.
- Draw the line between the office network and the plant network. Block direct paths from office machines to controllers, and allow data exchange through one controlled point.
- Turn on logging at the firewall and the remote access gateway.
Week 4: rehearse and plan
- Run a short manual operation drill on one line, with operations leading.
- Write a one page contact sheet for vendors, integrators and your insurer.
- Decide who may disconnect the plant from the office network in an emergency.
- Set a 90 day list from what you learned: patching, replacing unchangeable passwords, better monitoring and a fuller standard such as ISA/IEC 62443.
Where Safeguard fits
For the business software around the plant, such as dashboards, order systems and integration code, Safeguard offers dependency scanning and SBOM generation, with a free scan at https://gold.safeguard.sh/scan. It does not scan controllers or monitor plant networks.
What this will not cover
Thirty days will not give you a mature program. It removes the easy routes the agencies keep warning about. Plan the rest with your integrators and vendors, who can offer system specific guidance.
Quick check
What if we cannot find anyone who knows the equipment?
Start with the integrator or vendor who installed it. Their documentation and support contacts belong in your inventory.
Do we need to buy a monitoring product in 30 days?
No. Close exposure, control remote access and log the boundary first. Buy monitoring once you know what you are watching.
Sources
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance
Last reviewed: 19 October 2026.
