Engineering Sector Cyber Security Guide

Protecting Your Business, IP, and Supply Chain Position

A practical guide for engineering firms, precision manufacturers, and aerospace suppliers

Published: January 2026

Author: Dead Simple Computing Ltd

Version: 1.0

Contents

• Executive Summary
• Why Engineering Firms Are Targets
• The Threats You Face
• Customer Requirements
• Regulatory Landscape
• Protecting Your Intellectual Property
• Securing Operational Technology
• The Defence Supply Chain
• Aerospace and Aviation
• Getting Certified
• Building Your Security Programme
• Security Checklist for Engineering Firms
• How DSC Can Help

1. Executive Summary

Engineering firms face unique cyber security challenges. You hold valuable intellectual property, operate in complex supply chains, and increasingly face security requirements from customers in defence, aerospace, and critical infrastructure.

Key challenges:

• Intellectual property theft - Designs, processes, and innovations are targets for competitors and nation-states
• Supply chain position - Your compromise can affect customers in critical sectors
• Customer requirements - Defence primes, aerospace OEMs, and others require certifications
• OT/IT convergence - Connected manufacturing systems create new vulnerabilities
• Resource constraints - SME engineering firms lack dedicated security teams

What you need:

• Security that protects IP and meets customer requirements
• Certifications that win contracts (CE+, ISO 27001)
• Understanding of defence and aerospace requirements
• Practical controls that don't disrupt operations

The opportunity:

Engineering firms that demonstrate strong security will win business from those that don't. As supply chain security requirements increase, certified and compliant suppliers have competitive advantage.

2. Why Engineering Firms Are Targets

You Hold Valuable Assets

Intellectual property:

• Product designs and CAD files
• Manufacturing processes and methods
• Research and development data
• Prototypes and test results
• Customer specifications
• Proprietary software and algorithms

Business intelligence:

• Customer contracts and pricing
• Supplier relationships
• Bid and tender information
• Financial data
• Strategic plans

Controlled information:

• Defence-related technical data
• Export-controlled information
• Customer confidential data
• Security clearance information

Your Position in Supply Chains

Engineering firms often occupy critical positions in supply chains:

• Sole-source or limited-source components
• Specialist capabilities not easily replicated
• Long qualification and approval processes
• Deep integration with customer systems and data

Attackers understand that compromising a supplier can:

• Provide access to multiple customers
• Yield valuable IP from across the supply chain
• Disrupt critical production for major programmes
• Go undetected longer than direct attacks

Who Wants Your Data

Nation-state actors:

• Industrial espionage for economic advantage
• Military/defence intelligence gathering
• Pre-positioning for future disruption
• Technology transfer to domestic industries

Countries with known interest in UK engineering IP include China, Russia, Iran, and others. NCSC and MI5 have issued specific warnings about targeting of UK engineering and aerospace sectors.

Competitors:

• Domestic and international competitors seeking advantage
• May use criminal hackers or insider threats
• Particularly interested in bid information and pricing

Criminal groups:

• Ransomware targeting operational disruption
• Data theft for sale or extortion
• Business email compromise for financial fraud

Opportunistic attackers:

• Automated scanning and exploitation
• Phishing campaigns
• Malware distribution

3. The Threats You Face

Intellectual Property Theft

Methods:

• Spear phishing targeting engineers with access to designs
• Compromised remote access to CAD/PLM systems
• Insider threats (malicious or negligent)
• Supply chain compromise through trusted partners
• Physical theft of devices containing IP

Indicators:

• Unusual data transfers, especially to foreign locations
• Access to systems outside normal patterns
• Large file downloads or exports
• Use of personal email or cloud storage for work data

Impact:

• Loss of competitive advantage
• Wasted R&D investment
• Contract losses
• Regulatory penalties for export control breaches
• Reputational damage

Ransomware

Why engineering firms are attractive targets:

• Critical production systems create pressure to pay
• Limited downtime tolerance
• Often less mature security than larger enterprises
• May have cyber insurance

Impact:

• Production shutdown (days to weeks)
• Lost revenue and delivery penalties
• Customer relationship damage
• Recovery costs
• Potential data theft in addition to encryption

2025 UK examples:

• Jaguar Land Rover production halted for nearly a month
• Estimated £50+ million per week in losses
• 104,000 supply chain jobs affected
• Small suppliers pushed "to the brink of collapse"

Business Email Compromise

Common scenarios:

• Fake invoices from "suppliers" with changed bank details
• CEO fraud requesting urgent transfers
• Customer impersonation changing delivery instructions
• Vendor impersonation requesting information

Engineering-specific angles:

• "Updated drawings attached" with malware
• Fake RFQ responses
• Impersonation of quality/audit personnel

Supply Chain Attacks

You as the target:

Your suppliers or partners are compromised, and that compromise reaches you through:

• Software updates
• Shared systems
• Trusted communications
• Physical components

You as the vector:

You are compromised, and attackers use your access to reach your customers through:

• Your legitimate credentials
• Trusted email communications
• Shared collaboration platforms
• Delivered products or data

Insider Threats

Types:

• Malicious: Deliberate theft or sabotage
• Negligent: Accidental exposure through poor practices
• Compromised: Credentials or devices stolen

Engineering-specific risks:

• Engineers leaving for competitors (taking IP)
• Contractors with excessive access
• Third-party engineers on-site
• Remote access for field service

4. Customer Requirements

The Growing Burden

Engineering firms, particularly SMEs, face increasing security requirements from customers:

• Security questionnaires (sometimes 100+ questions)
• Certification requirements (CE+, ISO 27001)
• Audit rights and site visits
• Contractual security obligations
• Flow-down of prime contractor requirements

This is driven by:

• Supply chain attacks on major companies
• Regulatory requirements flowing down
• Insurance requirements
• Customer risk management programmes

What Customers Are Asking For

Certifications:

Security questionnaires:

Common topics include:

• Information security policies
• Access control
• Data protection and encryption
• Network security
• Incident response
• Business continuity
• Physical security
• Personnel security
• Third-party/supplier management
• Security awareness training

Contractual requirements:

• Compliance with named standards
• Incident notification (often 24-48 hours)
• Audit rights
• Data handling requirements
• Flow-down to your suppliers
• Insurance requirements

Responding to Requirements

Be honest:

• Don't claim compliance you can't evidence
• Acknowledge gaps with remediation plans
• Questionnaire responses may be audited

Be prepared:

• Maintain a master questionnaire response
• Keep evidence organised and accessible
• Know your certifications and their scope
• Track expiry dates

Be proactive:

• Get certified before customers require it
• Address common gaps before they're found
• Build security into operations, not as an afterthought

5. Regulatory Landscape

Current Regulations

Data Protection (GDPR/UK GDPR):

• Applies to all personal data processing
• Requires appropriate security measures
• Breach notification within 72 hours
• Significant penalties for non-compliance

Export Controls:

• UK Strategic Export Controls
• US ITAR/EAR (if handling US-origin technical data)
• Requires controls over who can access controlled data
• Penalties for breaches include criminal prosecution

NIS Regulations:

• Currently applies to operators of essential services
• Engineering firms generally not directly in scope
• BUT: Your customers in energy, transport, etc. may flow requirements down

Coming Regulations

Cyber Security and Resilience Bill:

• MSPs brought into scope (if you use them, they'll be regulated)
• Supply chain security requirements increase
• "Designated Critical Supplier" status possible
• 24-hour incident reporting
• Higher penalties

What this means for engineering:

• Customers in CNI will require more from suppliers
• Security questionnaires will intensify
• Certification may become contractually mandatory
• Your own MSP/IT providers will be regulated

Defence-Specific Requirements

Cyber Essentials Plus:

• Mandatory for MOD contracts involving certain information
• Often required by defence primes for supply chain

DEFCON 658:

• Defence Condition for cyber security
• Flows down through supply chain
• Requires specific security measures
• Links to Defence Standard 05-138

Defence Standard 05-138:

• Detailed cyber security requirements
• Risk-based approach
• Specific controls for different risk levels

Security aspects of contracts:

• May require security clearances
• Physical security requirements
• Handling instructions for controlled information
• Audit and inspection rights

Aerospace Requirements

AS9100:

• Quality management with some security elements
• Increasingly includes cyber security considerations

Customer-specific:

• Major OEMs have their own security requirements
• Flow-down through tier structure
• Often require ISO 27001 or equivalent

Nadcap:

• Special process accreditation
• Some cyber security elements emerging

6. Protecting Your Intellectual Property

Classification

Identify what matters:

• Not everything is equally sensitive
• Focus protection on crown jewels
• Consider: What would hurt most if stolen?

Classification scheme:

• Public: Can be shared freely
• Internal: Not for external sharing without approval
• Confidential: Restricted distribution, business sensitive
• Highly Confidential: Strict need-to-know, critical IP

Apply consistently:

• Label documents and files
• Train staff on handling requirements
• Enforce through technical controls where possible

Access Control

Principle of least privilege:

• Users get access only to what they need
• Review access regularly
• Remove access promptly when roles change

Technical controls:

• Role-based access in CAD/PLM systems
• Project-based access restrictions
• MFA for sensitive systems
• Privileged access management

Physical controls:

• Secure areas for sensitive work
• Visitor management
• Clean desk policy
• Device security

Data Loss Prevention

Technical measures:

• Monitor and control data transfers
• Restrict USB and removable media
• Control cloud storage usage
• Email filtering for sensitive content

Process measures:

• Approval required for external transfers
• Logging and audit trails
• Regular review of access and transfers

Awareness:

• Staff understand what's sensitive
• Know the rules for sharing
• Report suspicious requests

Protecting CAD and Design Data

System security:

• Secure CAD workstations
• Secure PLM/PDM systems
• Access controls and audit logging
• Secure backup and recovery

Network security:

• Segment design systems from general network
• Control remote access carefully
• Monitor for unusual activity
• Secure connections to customers/partners

Export and sharing:

• Controlled export processes
• Watermarking where appropriate
• Secure file transfer mechanisms
• Track what's been shared with whom

7. Securing Operational Technology

The Challenge

Modern manufacturing increasingly connects operational technology (OT) to IT networks:

• CNC machines connected for programming and monitoring
• SCADA systems for process control
• IoT sensors throughout production
• Integration with ERP and planning systems

This connectivity brings benefits but creates vulnerabilities:

• Legacy OT systems never designed for connectivity
• Different lifecycles (OT systems run for decades)
• Different priorities (availability over confidentiality)
• Limited patching capability
• Vendor access requirements

OT-Specific Risks

Ransomware affecting production:

• Production systems encrypted or disrupted
• Safety systems potentially affected
• Long recovery times for complex systems

Process manipulation:

• Subtle changes to production parameters
• Quality issues in output
• Safety risks from modified processes

Espionage:

• Production data reveals capabilities and capacity
• Process parameters are valuable IP

Securing OT Environments

Network segmentation:

• Separate OT network from IT network
• Controlled access points between networks
• Firewalls with OT-aware rules
• DMZ for shared services

Access control:

• Limit who can access OT systems
• Control vendor/remote access carefully
• Strong authentication where possible
• Audit logging

Monitoring:

• Monitor OT network traffic for anomalies
• Asset inventory of all connected devices
• Vulnerability awareness

Patching and updates:

• Patch management process for OT (different from IT)
• Test updates before deployment
• Compensating controls where patching not possible

Backup and recovery:

• Backup OT configurations
• Test recovery procedures
• Maintain manual operation capability

Starting Points

If you're new to OT security:

• Inventory - Know what's connected
• Segment - Separate OT from IT
• Access - Control who connects
• Monitor - Visibility into OT network
• Plan - Incident response for OT

8. The Defence Supply Chain

Understanding Defence Requirements

The UK defence supply chain has specific cyber security requirements flowing from MOD through prime contractors to the supply chain.

Key drivers:

• Protection of national security information
• Protection of controlled technical data
• Supply chain resilience for defence capability
• Threat from sophisticated nation-state actors

Cyber Essentials Plus

What it is:

• Government-backed certification
• Five technical control themes
• Independent technical verification
• Annual recertification

Why it matters for defence:

• Mandatory for many MOD contracts
• Required by most defence primes for suppliers
• Demonstrates baseline security

The five controls:

• Firewalls
• Secure configuration
• User access control
• Malware protection
• Patch management

DEFCON 658 and Def Stan 05-138

DEFCON 658:

• Defence condition that flows down in contracts
• Requires implementation of cyber security measures
• References Defence Standard 05-138
• Triggers specific handling requirements

Def Stan 05-138:

• Defence Standard for Cyber Security for Defence Suppliers
• Risk-based approach
• Defines cyber risk categories
• Specifies controls for each category

What this means in practice:

• Identify what category your work falls into
• Implement required controls
• Maintain evidence of compliance
• Flow requirements to your suppliers

Handling Controlled Information

Types of controlled information:

• Official-Sensitive
• MOD Identifiable Information
• Controlled Technical Information
• Export-controlled data

Requirements typically include:

• UK-based storage and processing
• Access limited to appropriate personnel
• Encryption in transit and at rest
• Audit logging
• Incident reporting to customer
• Secure destruction when no longer needed

JOSCAR (Joint Supply Chain Accreditation Register)

What it is:

• Supplier qualification system for defence and aerospace
• Single portal for supplier information
• Security information component

What you need to provide:

• Company information
• Security certifications
• Policy information
• Compliance statements

9. Aerospace and Aviation

Customer Expectations

Aerospace OEMs and Tier 1 suppliers increasingly require:

• ISO 27001 certification
• Cyber security questionnaire responses
• Audit rights
• Incident notification
• Flow-down to your suppliers

Major OEMs (Airbus, Boeing, Rolls-Royce, etc.) have supply chain security programmes with specific requirements.

Protecting Programme Information

Aerospace programmes involve:

• Long development cycles
• Significant IP in designs
• Competitive sensitivity of programme details
• Export control considerations

Protection requirements:

• Access control by programme
• Information classification
• Secure collaboration with customers
• Contractual confidentiality

Aviation Fuel Supply Chain

Aviation fuel suppliers face specific requirements from airport operators:

• Security questionnaires (often 100+ questions)
• ISO 27001 increasingly required
• NIS2 implications (aviation is CNI)
• Operational technology security

DSC has direct experience in aviation fuel operations - we understand your environment.

Export Controls

Aerospace often involves export-controlled technical data:

UK controls:

• Strategic Export Controls
• End-use monitoring
• Controlled destination awareness

US controls (ITAR/EAR):

• If you handle US-origin technical data
• Strict controls on access and transfer
• Non-US person restrictions
• IT system requirements

What this means:

• Know what's controlled
• Control access appropriately
• Maintain records
• Include in security programme

10. Getting Certified

Cyber Essentials

What it is:

• Self-assessment questionnaire
• Verified by certification body
• Annual recertification
• Covers basic security controls

Best for:

• Starting point for security maturity
• Lower-risk contracts
• Demonstrating baseline security
• Foundation for CE+

Process:

• Complete self-assessment questionnaire
• Submit to certification body
• Receive certificate (if compliant)
• Recertify annually

Typical timeline: 2-4 weeks

Cyber Essentials Plus

What it is:

• Same controls as CE
• Plus independent technical verification
• Assessor tests your actual systems
• Higher assurance

Best for:

• Defence contracts
• Aerospace supply chain
• Higher-risk environments
• Customer requirements

Process:

• Achieve Cyber Essentials first
• Assessor conducts technical testing
• External vulnerability scan
• Internal testing
• Receive certificate (if compliant)

Typical timeline: 4-8 weeks

Common failure points:

• Unpatched systems
• Weak password policies
• Missing MFA
• Excessive admin rights
• Unsupported software

ISO 27001

What it is:

• International standard for information security management
• Comprehensive ISMS (Information Security Management System)
• Covers policies, processes, and controls
• Certified by accredited certification bodies
• Annual surveillance audits, 3-year recertification

Best for:

• Major customer requirements
• Complex security needs
• Demonstrating mature security programme
• International recognition

Process:

• Gap analysis
• ISMS design and documentation
• Implementation
• Internal audit
• Management review
• Stage 1 audit (documentation review)
• Stage 2 audit (implementation verification)
• Certification
• Ongoing surveillance

Typical timeline: 6-12 months for initial certification

Which Certification Do You Need?

DSC Certification Support

We help engineering firms achieve and maintain certifications:

• Gap assessment
• Remediation support
• Documentation development
• Implementation guidance
• Audit preparation
• Ongoing compliance management

11. Building Your Security Programme

Start With Basics

If you have limited security today:

• Get Cyber Essentials - Establishes baseline
• Enable MFA everywhere - Single biggest impact
• Patch consistently - Automated where possible
• Backup and test recovery - Ransomware resilience
• Train your people - Awareness is critical

Build Systematically

For growing maturity:

• Policies and procedures - Document your approach
• Asset management - Know what you have
• Access control - Right access to right people
• Monitoring - Know what's happening
• Incident response - Plan for when things go wrong

Address Engineering-Specific Needs

IP protection:

• Classify your information
• Control CAD/PLM access
• Monitor data transfers
• Secure collaboration

OT security:

• Segment from IT
• Control access
• Monitor for anomalies
• Plan for incidents

Supply chain:

• Assess your suppliers
• Include security in contracts
• Respond to customer requirements
• Flow down requirements

Consider Managed Services

For engineering SMEs without dedicated security teams:

Managed IT with security built in:

• Endpoint protection
• Patching and updates
• Monitoring and alerting
• Secure configuration

Managed security services:

• 24/7 monitoring (MDR)
• SIEM for log management
• Vulnerability scanning
• Incident response support

Compliance support:

• Certification achievement and maintenance
• Questionnaire responses
• Audit preparation
• Ongoing compliance management

12. Security Checklist for Engineering Firms

Governance

• ☐ Information security policy exists and is communicated
• ☐ Security responsibilities are assigned
• ☐ Management reviews security regularly
• ☐ Security budget is allocated

People

• ☐ All staff receive security awareness training
• ☐ Training covers engineering-specific risks
• ☐ Joiners, movers, leavers process manages access
• ☐ Contractors and third parties are managed

Access Control

• ☐ Unique accounts for all users
• ☐ MFA enabled on critical systems
• ☐ Privileged access is controlled
• ☐ Access reviewed regularly
• ☐ Leavers' access removed promptly

Data Protection

• ☐ Information is classified
• ☐ Sensitive data is encrypted (transit and rest)
• ☐ Data transfers are controlled
• ☐ Backups are performed and tested
• ☐ Retention and destruction procedures exist

Technical Security

• ☐ Firewalls protect network boundaries
• ☐ Systems are patched regularly
• ☐ Anti-malware is deployed and updated
• ☐ Secure configuration standards applied
• ☐ Removable media controlled

CAD/PLM Security

• ☐ Access control by project/need
• ☐ Audit logging enabled
• ☐ External sharing controlled
• ☐ Backup and recovery tested

OT Security (if applicable)

• ☐ OT network segmented from IT
• ☐ Remote access controlled
• ☐ Asset inventory maintained
• ☐ Monitoring in place

Incident Response

• ☐ Incident response plan exists
• ☐ Contact details current
• ☐ Plan has been tested
• ☐ Reporting obligations understood

Compliance

• ☐ Certifications current (CE, CE+, ISO 27001)
• ☐ Customer requirements tracked
• ☐ Questionnaire responses maintained
• ☐ Audit evidence organised

Supply Chain

• ☐ Critical suppliers identified
• ☐ Supplier security assessed
• ☐ Contracts include security requirements
• ☐ Requirements flowed down appropriately

13. How DSC Can Help

Dead Simple Computing provides managed IT, security services, and compliance support for engineering firms.

Managed IT

Compliance-Ready Managed IT:

• IT support with security built in
• Meets customer security requirements
• Evidence and reporting as standard
• Supports certification maintenance

Security Services

MDR (Managed Detection & Response):

• 24/7 monitoring
• Threat detection and response
• Monthly reporting

SIEM:

• UK-based log management (Assuria)
• Meets data residency requirements
• Compliance reporting

Vulnerability Management:

• Regular scanning
• Prioritised remediation
• Evidence for audits

Compliance Support

Certification:

• Cyber Essentials / CE+
• ISO 27001
• Gap assessment to certification

Customer Requirements:

• Questionnaire response support
• Audit preparation
• Evidence documentation

Advisory

vCISO:

• Strategic security leadership
• Customer and audit engagement
• Board reporting
• Ongoing security oversight

Assessments:

• Current state assessment
• Gap analysis
• Roadmap development

Why DSC for Engineering

• We understand regulated industries
• CISSP qualified, ISO 27001 certified
• Experience with defence and aerospace requirements
• Practical approach that fits engineering operations
• UK-based team and data

Contact us:

• Web: deadsimplecomputing.co.uk
• Email: [email protected]
• Phone: 0118 359 2220

About This Guide

This guide was prepared by Dead Simple Computing Ltd in January 2026 to help engineering firms understand and address their cyber security challenges.

This guide is for informational purposes and does not constitute legal advice. Organisations should seek appropriate professional advice for their specific circumstances.

© 2026 Dead Simple Computing Ltd. All rights reserved.