Cyber Essentials Plus for manufacturing and engineering firms is the certification that OEMs, primes and public sector buyers now write into supply chain contracts. This guide covers what the audit actually checks, which certification route fits a shop floor, and where firms lose points.
Why this matters in 2026
More tier-1 automotive, aerospace and defence primes now list Cyber Essentials Plus as a contract condition, not a nice-to-have. Government supply chains and MOD subcontracts increasingly demand it before a purchase order is even signed.
Manufacturing firms already hold plenty of certifications. Many of the same sites carry ISO 9001 for manufacturing and engineering firms, which covers quality management and says nothing about cyber risk. Cyber Essentials Plus fills that gap with an independently verified technical audit, not a self-assessment.
The scheme is unforgiving on timelines. Certification is valid for 12 months, and the technical audit re-runs every renewal — there's no carry-over credit for last year's clean scan.
Who this is for
This is written for the IT manager or operations director at a manufacturing or engineering SME, typically 20 to 250 staff, supplying automotive, aerospace, defence or public sector buyers. You're dealing with a split estate: office IT that looks like any other business, and a shop floor running CNC controllers, PLCs and machine PCs that were never designed with a 2026 vulnerability scan in mind.
What to look for in Cyber Essentials Plus for manufacturing
Scope that separates office IT from OT
Your certification body needs a clear, documented boundary between corporate laptops and shop-floor control systems. Get this wrong and the audit either drags in unpatchable legacy PLCs or gets flagged for undocumented exclusions.
A certification body with manufacturing experience
Auditors who've never seen a CNC network waste your time asking the wrong questions. Ask any shortlisted body how many manufacturing or engineering clients they've certified in the last 12 months.
Patch discipline across legacy machinery
Cyber Essentials Plus requires critical and high severity vulnerabilities to be patched within 14 days of release. Machine-control PCs running unsupported Windows builds are the single most common failure point for manufacturing applicants.
Evidence collection that doesn't eat a week of someone's time
Manual evidence chasing — screenshots, email threads, spreadsheet trackers — is where most manufacturing compliance projects stall. Automated evidence collection turns this into a background process instead of a project.
Renewal cost and admin over a 12-month cycle
Cyber Essentials Plus isn't a one-time cost. Budget for the annual vulnerability scan, the technical audit, and the internal hours spent preparing for both, every 12 months.
Vendor risk from CNC and PLC suppliers
Most manufacturing firms depend on third-party machine vendors for firmware updates. If a supplier can't confirm patch timelines, that risk shows up in your own audit.
The routes to Cyber Essentials Plus — ranked
DIY spreadsheet-and-consultant chase — the slow lane. Evidence gets pulled together through email threads, screenshots and a hired consultant who bills by the hour. Manufacturing SMEs running this route typically report a 6-to-8-week lead time before they're audit-ready, longer if multiple sites are involved. Skip unless you have nothing else booked this quarter.
Generic GRC platform built for SaaS — the wrong shape. Most off-the-shelf GRC tools ship zero manufacturing-specific control templates and no concept of an OT network segment. Consider only if you already have in-house security headcount to fill the gaps manually.
IASME-licensed certification body, booked direct — the mandatory partner. Cyber Essentials Plus can only be awarded by a licensed body, and the audit includes an external vulnerability scan plus on-site or remote device sampling. Pricing and manufacturing familiarity vary widely between bodies — see the best Cyber Essentials Plus certification bodies compared before you book. Buy — non-negotiable, but shop around.
Automated evidence collection ahead of the audit — the fast lane. Rather than waiting for the certification body to ask for patch logs and config screenshots, the evidence sits ready before the audit date is even confirmed. OneClickComply automates this for Cyber Essentials Plus applicants juggling both office and shop-floor scope. Pair it with the steps in how to prepare for a Cyber Essentials Plus audit. Buy for any manufacturer with more than one site or a mixed OT estate.
Get Cyber Essentials Plus done without the chase
Automated evidence collection handles the admin end-to-end.
What to avoid
- Treating Cyber Essentials Plus like the basic self-assessed version. Plus requires an independent technical audit, not a questionnaire you fill in yourself.
- Excluding shop-floor OT without written justification. Auditors will ask why a device is out of scope — "it's old" isn't an answer that passes.
- Assuming a clean certificate carries into next year automatically. Every renewal re-runs the vulnerability scan from zero.
Verdict comparison
| Route | Setup time | OT/shop-floor fit | Cost pattern | Verdict |
|---|---|---|---|---|
| DIY spreadsheet + consultant | 6-8 weeks | Poor | Hourly, unpredictable | Skip |
| Generic GRC platform | 3-4 weeks | Weak | Subscription + manual gap-filling | Consider |
| Certification body, direct | 2-3 weeks | Depends on auditor | Fixed audit fee | Buy |
| Automated evidence collection | 1-2 weeks | Strong | Predictable annual cost | Buy |
Frequently asked questions
One last thing
The 14-day patch rule for critical and high vulnerabilities is where manufacturing applicants fail most often, and it's rarely the office network's fault. It's the machine-control PC running an unsupported OS build because the CNC vendor never confirmed a patch SLA. Fix that vendor conversation before you book the audit, not after.