Is the operational technology (OT) side of manufacturing keeping decision-makers awake at night? Does uncertainty about policy wording, physical damage and business interruption from OT failures make it hard to decide whether to buy cover or self-insure? This guide explains, in clear UK terms, how Manufacturing & OT: cyber insurance for operational technology risks works for micro and small manufacturers and what to consider when assessing cover, premiums and contractual obligations.
Key takeaways: what to know in 60 seconds
- OT risk is different to IT risk. OT incidents can cause physical damage and prolonged business interruption, and standard cyber policies often do not cover those outcomes fully.
- OT-specific cover can be worth it for micro manufacturers when exposure to physical loss, product contamination or regulatory fines exists. Indicative thresholds are included below.
- Standalone OT policies and endorsements differ on scope and price; comparing limits, sub-limits and exclusions is essential before assuming cover is adequate.
- Business size affects premiums and limits through asset scale, production uptime value and historic claims; micro firms may face proportionally high deductibles or limited limits.
- Supply chain clauses now commonly require evidence of OT risk management; insurers and buyers both ask for asset inventories, network segmentation and incident playbooks.
Is OT-specific cyber cover worth it for micro manufacturers?
The decision for a micro manufacturer (1–10 employees) hinges on exposure, tolerable loss and contractual demands. OT-specific cyber cover is often worth considering when one or more of the following applies:
- The site uses PLCs, SCADA, DCS or similar industrial control systems controlling production lines, ovens, conveyors or safety-critical equipment.
- A ransomware or malware event could cause physical damage, product spoilage or contamination that would lead to customer claims or regulatory action.
- The cost of downtime exceeds available working capital or would lead to insolvency.
- Contracts with larger customers or regulators require evidence of insurance covering OT incidents.
When exposure is low, for example, manual processes with isolated legacy machinery and no remote access, standard cyber cover plus targeted risk controls may suffice. However, even modest automation can escalate losses rapidly because physical processes run 24/7 and stoppages cascade.
When OT cover makes financial sense for a micro manufacturer
- The replacement or repair cost of critical OT components that have long lead times (months) is high relative to turnover.
- Downtime costs (lost production, expedited shipping, penalty clauses) exceed insurance premiums materially.
- The firm handles regulated products (food, pharmaceuticals) where contamination could trigger large third-party claims or regulatory fines from the ICO or other regulators.
When OT cover may be less necessary
- Processes are low-speed, easily restartable and spare parts are inexpensive and on-hand.
- No remote connectivity and demonstrable physical isolation of OT from external networks.
- Contractual partners do not require OT coverage and business interruption would not threaten business continuity.
Standalone OT insurance vs standard cyber policies for SMEs
Manufacturing & OT: cyber insurance for operational technology risks sits on a spectrum: from a standard SME cyber policy (IT-focused) to a standalone OT or hybrid policy designed for industrial control systems.
Below is an HTML comparison table highlighting typical feature differences and common exclusions (rows alternate background for readability):
| Feature |
Standard SME cyber policy |
Standalone OT / hybrid policy |
| Typical focus |
Data breach, incident response, liability for data loss |
Physical damage, equipment repair, contamination, BI from production stoppage |
| Business interruption (BI) |
Often limited to IT downtime; short waiting periods |
Extended BI cover for OT events, including physical restart costs |
| Physical damage |
Usually excluded |
Included for specified perils (malware affecting safety systems, actuator failure due to cyber intrusion) |
| Typical exclusions |
Wear and tear, deliberate illegal acts, physical perils not caused by cyber events |
Pollution, legacy system failure unrelated to cyber event, non-identified insecure OT devices |
What standalone OT policies typically cover
- Physical damage to machinery caused directly by a cyber attack (where the policy wording permits).
- Extended business interruption reflecting longer restart and validation times for OT systems.
- Contamination or spoilage for regulated products such as food and pharmaceuticals.
- Third-party liability arising from defective products after an OT compromise.
Common gaps in standard cyber policies
- Explicit exclusions for physical damage caused by control system manipulation.
- Limited BI periods that assume an IT restore in hours rather than days or weeks.
- No cover for safety functional failures (e.g. SIL-rated safety systems) unless specifically endorsed.
Practical comparison approach for SMEs
- Request sample policy wordings or endorsements and review definitions for “cyber incident”, “physical loss or damage”, and “business interruption”.
- Ask insurers what evidence they require to accept OT claims (asset inventories, network segmentation diagrams, preventive controls).
- Consider endorsements that extend BI periods and add physical damage cover rather than a separate standalone policy if premium and wording suit the risk profile.
OT cover decision flow for small manufacturers
✅ Follow this simple flow to decide whether to seek OT-specific cover
🔎 Step 1 → Is critical production controlled by PLCs/SCADA with remote interfaces?
→ Yes ✅: proceed to Step 2. No ✗: standard cyber + controls may suffice.
⚙️ Step 2 → Could an attack cause physical damage or contamination?
→ Yes ✅: OT-specific cover likely valuable. No ✗: consider endorsements.
📜 Step 3 → Do contracts require OT insurance or proof of controls?
→ Yes ✅: gather documentation and approach insurers for OT wording. No ✗: weigh costs vs retained risk.
Result → If two or more answers are Yes, engage specialist underwriters or brokers experienced in OT cover.
How business size affects OT risk premiums and limits
Business size matters because insurers price on exposure, likely severity and the ability to absorb losses.
Premium drivers that scale with size
- Asset value and replacement cost. Larger operations typically use more sophisticated and expensive OT, driving higher sums insured and premiums.
- Production throughput value. Policies often calculate business interruption on gross profit or declared turnover; higher throughput equals greater exposure.
- Complexity and connectivity. Larger plants may have greater OT/IT integration and remote access, increasing attack surface.
- Claims history and sector frequency. Certain manufacturing subsectors (chemicals, food, pharmaceuticals) attract higher rates due to contamination or safety implications.
How limits and deductibles change for micro vs small manufacturers
- Micro manufacturers may be offered lower aggregate limits or higher relative deductibles because the administrative cost of underwriting small risks can be high.
- Small manufacturers (11–50 employees) with continuous production may secure higher limits and more favourable waiting periods but pay higher absolute premiums.
- Insurers may apply sub-limits for specific exposures (contamination, product recall) meaning a £1m policy may have only £250k for contamination claims.
Examples (indicative at time of writing)
- A micro bakery with a single automated oven: insurer may quote a cyber policy with an OT endorsement, BI waiting period 48–72 hours, contamination sub-limit £50k and deductible £5k; annual premium from a few hundred to low thousands depending on turnover and controls.
- A small electronics assembler with multiple PLC-controlled lines: insurer may expect dedicated OT wording, BI period of 30 days or more, higher sums insured and premiums in low-to-mid five figures.
All figures are indicative and depend on underwriting questions, historic loss data and the strength of cyber/OT controls.
Costs of inadequate OT cover for small manufacturers
Inadequate cover can lead to material financial stress. Typical cost categories include:
- Direct repair or replacement costs for damaged controllers, actuators or conveyor systems.
- Business interruption, lost sales, contractual penalties and expedited shipping costs to fulfil orders.
- Product recall and third-party claims if compromised products reach customers.
- Regulatory fines and remediation costs where safety or data breaches trigger investigations (refer to ICO or sector regulators).
- Reputational damage leading to lost contracts and longer-term revenue decline.
Case scenario (realistic, anonymised)
A midsize food packer experienced a malware attack that manipulated line speeds and temperature control, causing product spoilage over several days. The firm lacked an OT-specific extension and the standard cyber policy denied physical damage claims. Direct losses (wasted product, disposal, clean-up) and BI exceeded £450k, with additional costs for customer refunds and reputational loss.
Why underinsurance is dangerous
- Policies with insufficient BI periods or low contamination sub-limits can leave firms with large out-of-pocket costs.
- Exclusions for legacy systems or lack of patching can invalidate claims if insurers find material non-disclosure of OT weaknesses.
Should companies self-insure OT losses or buy cover?
Self-insurance (retaining risk) is a legitimate strategy for many micro manufacturers but requires clear analysis.
When self-insuring is sensible
- When worst-case financial exposure is materially less than the annual premium and the firm has cash reserves to absorb losses.
- When OT risk is small, rare and the business can restart quickly with spare parts and manual processes.
When buying cover is preferable
- When a single event could cause catastrophic loss relative to capital or cashflow, risking insolvency.
- When contractual partners require proof of insurance or when regulatory consequences could be large.
Risk-pooling and alternatives
- Mutual arrangements or trade association schemes can provide pooled OT risk cover at lower cost for similar businesses.
- Captive insurance is rarely practical for micro firms due to capital requirements but may suit groups of related businesses.
Practical checklist to decide between self-insurance and transfer
- Model the maximum probable loss from an OT event (repair + BI + third-party costs).
- Compare that figure to available cash and credit facilities.
- Consider the non-financial impact (customer loss, licence risk).
- Get indicative quotes to compare premium vs expected retained cost.
Supply chain clauses and insurance requirements for manufacturers
Contractual obligations increasingly require buyers and suppliers to carry specific insurance or to demonstrate controls.
Common contractual clauses
- Minimum insurance limits: e.g. evidence of £1m public/product liability and specified cyber/OT cover with defined BI periods.
- Indemnity clauses: suppliers may be required to indemnify buyers for losses caused by a supplier-origin OT incident.
- Proof of controls: demand for annual SOC-type reports, network diagrams, asset inventories and evidence of segmentation.
What insurers expect buyers and suppliers to show
Insurers underwriting OT exposure commonly request:
- An OT asset inventory (make/model, firmware version, remote access points).
- Network segmentation diagrams showing separation between IT and OT or the presence of secure gateways and firewalls.
- Incident response playbooks and evidence of tabletop exercises.
- Patch management and vulnerability scanning logs where applicable.
- Third-party assessments or penetration test reports for remote access systems.
All documentation should be ready to share with brokers and underwriters; withholding key facts risks coverage disputes.
How to handle supply chain insurance demands
- Map which contracts impose insurance conditions and align policy limits and wording accordingly.
- Negotiate realistic clauses, some buyers accept reasonable endeavours to obtain cover when specialist OT policies are unavailable.
- Maintain clear evidence of controls and remediation timelines to present to both customers and insurers.
Advantages, risks and common mistakes
✅ Benefits of OT-specific cover or careful endorsements
- Tailored protection for physical damage and extended BI designed for industrial processes.
- Clearer expectations with customers and reduced contractual friction.
- Access to specialist loss adjusters who understand OT recovery pathways.
⚠️ Common mistakes and risks to avoid
- Assuming a standard cyber policy covers physical damage from OT compromise without checking the wording.
- Failing to provide required underwriting documents (asset inventory, network maps), causing delays or declinature.
- Under-declaring production uptime value when calculating BI leading to insufficient limits.
- Overlooking pollution/contamination exclusions which frequently apply to OT losses.
Frequently asked questions
What is operational technology (OT) in manufacturing?
Operational technology refers to hardware and software that monitors or controls physical processes, such as PLCs, SCADA and building management systems used on the factory floor.
Does the ICO regulate OT incidents?
The Information Commissioner's Office (ICO) regulates personal data breaches; if an OT incident results in personal data loss, the ICO may be involved. For safety, environmental or product issues, sector regulators apply. See ICO guidance.
Will a standard cyber policy pay for damaged machinery?
Many standard cyber policies exclude physical damage. If physical loss is a potential outcome, seek an OT-specific endorsement or standalone policy and review definitions carefully.
How much does OT insurance cost for small manufacturers?
Costs vary widely depending on turnover, asset value, BI exposure and controls. Indicative premiums range from a few hundred pounds (simple micro setups) to several thousand for more automated small plants. Obtain quotes for accurate figures.
What documentation do insurers ask for when underwriting OT risks?
Common requirements include OT asset inventory, network segmentation diagrams, incident response plans and recent vulnerability assessments. Providing these speeds up underwriting.
Can contractual customers force a manufacturer to buy OT insurance?
Contracts can require suppliers to hold certain insurance levels. If the insurer declines to cover OT risk, negotiation or risk-sharing clauses (e.g. indemnities) may be necessary.
Is business interruption for OT events calculated the same as IT BI?
No. OT BI often requires longer waiting periods and different calculations because restarting validated OT processes can take longer and need specialist validation.
Are there standard industry standards for OT security that insurers respect?
Yes. Insurers commonly reference NCSC guidance and sector standards (e.g. IEC 62443 for industrial control systems). Relevant guidance: NCSC and HM Government cyber guidance.
Practical how-to: preparing documentation insurers request
Step 1: create a concise OT asset inventory
Include device type, model, firmware, network connection points, remote access and criticality ranking.
Step 2: map network segmentation
Produce a simple diagram showing IT/OT separation, firewalls, and jump hosts.
Step 3: assemble incident playbook snippets
Short sequences for detection, containment, rebuild and business continuity showing responsible staff and vendors.
Step 4: gather evidence of controls and testing
Vulnerability scan reports, patch records and evidence of physical access control strengthen submissions.
Step 5: get an insurer-ready summary
One-page summary showing maximum probable loss, BI calculation and any contractual insurance limits.
Conclusion
Manufacturing & OT: cyber insurance for operational technology risks demands focused attention. For many micro and small manufacturers, OT exposures are qualitatively different to IT risks and require specific wording, evidence and sometimes standalone policies. Proper preparation, asset inventories, network segmentation and incident playbooks, improves the chance of securing suitable cover at a reasonable price.
Next steps
- List three critical OT assets and estimate their replacement and downtime cost.
- Produce a one-page OT asset inventory and network diagram to share with brokers.
- Request two OT-specific quotes or endorsements and compare wording for physical damage, BI period and sub-limits.
