ISO 27001 requirements: what UK manufacturers need to know

A cyber incident at a manufacturer rarely stays in the office. It can stop production lines, delay deliveries and expose customer designs. For many suppliers, a certificate to ISO 27001 is now the practical way to show customers that information is handled with care.

This guide explains why the standard matters to manufacturers, what ISO 27001 requirements actually cover, and how to approach certification without turning it into a paperwork exercise.

What is ISO 27001?

ISO 27001 is an international standard for an information security management system (ISMS). It does not prescribe particular software or hardware. It sets out how an organisation should identify information risks, decide what to do about them, and keep improving.

Certification is carried out by independent certification bodies, which are normally accredited by a national body such as UKAS. A certificate usually covers a defined scope, such as a site, a business unit or a set of processes, so check what is included when a supplier shows you one.

Why information security matters on the factory floor

Modern plants depend on networked equipment. Programmable logic controllers, SCADA systems, MES and ERP software, and connected machines all hold or move data that production relies on.

Operational technology (OT) was often designed for reliability, not security, and some of it runs for decades without updates. That makes risk assessment and network segregation between office IT and the shop floor especially important.

The information worth protecting is also broader than many firms assume:

Customer drawings, specifications and tooling data
Your own process know-how and formulations
Production schedules and order data
Employee and supplier records
Quality and traceability records

Why customers ask for it in the supply chain

Large buyers, particularly in automotive, aerospace, defence and food, pass security expectations down to their suppliers. A weak link at a small machining or packaging firm can expose the whole chain.

ISO 27001 gives buyers a recognised benchmark. It can shorten security questionnaires and audits, and it may be a condition of tendering for some contracts. It is not the only route, and some sectors or government contracts use other schemes, such as Cyber Essentials in the UK, so confirm what your customers actually require.

What are the main ISO 27001 requirements?

The core clauses of the standard set out what an ISMS must contain. In broad terms, you need to:

Understand your context: internal and external issues, and the needs of interested parties such as customers and regulators
Define the scope of the ISMS
Show leadership commitment, with an information security policy and clear roles
Assess and treat risks through a documented, repeatable method
Provide resources, competence and awareness training
Control documented information
Monitor and measure performance, including internal audits and management reviews
Improve through corrective action

These clauses are mandatory for certification. You cannot leave them out because they are inconvenient.

What is Annex A?

Annex A is a reference list of security controls covering areas such as access control, supplier relationships, physical security, asset management, backup, logging and incident response. You select the controls that fit your risks and record your choices in a Statement of Applicability.

The control set has been revised in the past, so confirm you are working to the current edition of the standard and its transition arrangements.

Applying the standard to a manufacturing site

Scope decisions matter most. Including OT and production systems makes the certificate more meaningful to customers, but it adds complexity. Many firms start with a defined scope and extend it later.

Practical points to address early:

Keep an accurate inventory of IT and OT assets, including legacy machines
Segregate production networks from corporate networks
Control remote access by machine vendors and maintenance contractors
Set patching and compensating measures for equipment that cannot be updated
Back up controller configurations and test restoration
Control physical access to server rooms, cabinets and engineering workstations

How to approach certification

Start with a gap analysis against the standard. Appoint an owner with real authority, and involve operations and engineering as well as IT. Security programmes led only from the IT office tend to miss the plant.

Certification normally involves a two-stage audit by a certification body, followed by periodic surveillance audits and recertification. Timescales and costs vary with size, scope and existing maturity, so get quotes from more than one accredited body and confirm the current audit cycle requirements with your chosen certification body.

Keep the system proportionate. Auditors look for a system that is used, not a folder of policies nobody reads. Firms already running ISO 9001 or ISO 14001 can often reuse existing document control, internal audit and management review processes.

Is ISO 27001 mandatory for UK manufacturers?

No. It is a voluntary standard, but customers may make it a contract condition, so it is often a commercial requirement in practice.

How does ISO 27001 differ from Cyber Essentials?

Cyber Essentials is a UK scheme focused on a set of basic technical controls. ISO 27001 is an international management system standard that is broader and risk-based.

Does ISO 27001 cover operational technology?

It can, if OT is within your defined scope. The standard is technology-neutral, so you assess and treat risks to production systems in the same way as IT.

How long does ISO 27001 certification take?

It depends on the size of the business, the scope and your starting point. A gap analysis will give a realistic estimate.