IT Support for ManufacturingIT support for manufacturers, where downtime is measured in lost production.
In a factory, IT problems do not stay in the office. A locked ERP system stops orders being picked, an infected PC on the shop floor can reach the machine controllers, and a customer's security questionnaire left unanswered can cost the contract. We run the IT for manufacturers and engineering firms: the office and the shop floor kept apart, ERP and CAD kept patched and backed up, and the evidence your customers ask for, produced rather than promised.
Who this is for
Small and medium-sized manufacturers, engineering and fabrication firms, with an office, a shop floor and often a warehouse, running ERP or MRP such as Sage 200, SYSPRO, Epicor or Microsoft Dynamics 365 Business Central, and with IT looked after by the operations or finance manager on top of their real job.
The office network and the shop floor should not be the same network
Most ransomware that stops production does not start on a machine. It starts with an email opened in the office, then spreads across a flat network to every PC that can be reached, including the ones that run CNC machines, test rigs and label printers. The fix is not exotic: separate networks for office, production and guest devices, firewall rules that allow only the traffic each machine actually needs, and no general internet access from machine controllers.
Machine controllers often run versions of Windows the equipment maker will not let you upgrade. We do not pretend those can be patched like a laptop. We isolate them, restrict what can talk to them, control USB use, and back up their configuration and programs so a failed controller is a restore rather than a call to the machine builder. The NCSC's operational technology guidance takes the same approach.
Source: Operational technology (NCSC)
ERP, CAD and the server that runs the business
We support systems such as Sage 200, SYSPRO, Epicor and Microsoft Dynamics 365 Business Central, on premises and in the cloud. We are not the ERP vendor or your reseller, and will not pretend to be, but we keep the server and database patched, backed up with tested restores, reachable from the shop floor and from home through a supported route, and closed to the internet otherwise. Upgrades are scheduled with you around month end and production plans.
CAD and CAM workstations need more care than office PCs: graphics drivers, licence servers and large files on shared storage. We keep them on a patching schedule that does not reboot a workstation halfway through a job, and make sure drawings and programs are in the backup, not only on one engineer's desktop.
Customer questionnaires, Cyber Essentials and MOD contracts
Larger customers now send suppliers a cyber security questionnaire with the purchase terms, and many ask for Cyber Essentials as a minimum. For defence work, MOD contracts carry DEFCON 658 and a Cyber Risk Profile under the Defence Cyber Security Model, and those requirements apply to subcontracts as well as to the prime contractor.
We hold Cyber Essentials ourselves, and we take manufacturers through it as a fixed project: fix what would fail, then certify. After that the evidence (MFA, device compliance, patch status, backup tests) is kept as part of running the service, so the next questionnaire is a document request, not a fortnight of guesswork.
Source: Cyber Essentials (NCSC), Cyber Security Model (MOD, GOV.UK)
Shared PCs, shift workers and the warehouse
Shift staff often share a PC on the line or a terminal in stores. Shared log-ins mean nobody knows who did what and a leaver's password is still in use months later. Shared device set-ups in Intune, quick sign-in and short sessions let each person use their own account without slowing the shift down. Warehouse Wi-Fi is surveyed and designed for scanners and tablets, not just the office, so stock counts do not drop out at the far racking.
The helpdesk runs Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00, and our RMM monitoring and patching runs around the clock and raises alerts to the helpdesk. If you run night shifts or weekend production and need an engineer on call outside office hours, that is an optional extra rather than part of the standard price; speak to the team about it.
Source: Small Business Guide (NCSC)
On Google Workspace? We look after that too
Plenty of manufacturers run on Gmail and Google Drive rather than Microsoft 365. We support both, give honest advice on which fits, and do not ask you to move. For a Google Workspace business we enforce 2-Step Verification on every account, with security keys or passkeys for admins, keep admin roles to the people who need them, set Gmail's phishing and malware protection along with SPF, DKIM and DMARC so supplier and customer impersonation is harder, control external sharing on Drive and shared drives so drawings reach only the customers who should have them, restrict which third-party apps can connect, and alert on suspicious sign-ins and forwarding.
Office and shop-floor PCs are managed and protected properly either way, through Google endpoint management or Intune on a standalone licence, and network segregation, ERP support and Cyber Essentials work the same on either platform. Gmail, Drive, Calendar and Contacts are backed up outside Google and kept for seven years in the UK, as a separate per user service. A move between Google and Microsoft, in either direction, is quoted as a project if you ever want one.
What is included
Helpdesk and monitoring
Unlimited support answered by an engineer, Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00. Every device monitored and patched 24/7 by our RMM tooling, with alerts raised to the helpdesk and reboots scheduled around production.
Network segregation
Separate office, production and guest networks, firewall rules for each, and machine controllers kept off the open internet.
Microsoft 365 or Google Workspace secured
On Microsoft 365, Business Premium with MFA for everyone, Conditional Access, Defender for Office 365 tuned for supplier and customer impersonation, and mailbox forwarding rules monitored. On Google Workspace, 2-Step Verification enforced, Gmail phishing protection set and alerts on suspicious sign-ins and forwarding.
ERP, CAD and servers
Systems such as Sage 200, SYSPRO, Epicor and Business Central kept patched, backed up and reachable safely; CAD workstations and licence servers maintained.
Backup, tested
Microsoft 365 or Google Workspace, server, ERP database and machine program data backed up outside the vendor, kept in the UK, restores tested every quarter with the result shown to you. Microsoft 365 and Google Workspace backup is a separate service, priced per user per month on top of support.
Evidence for customers
Cyber Essentials certification, and documentation written to answer customer questionnaires and MOD supply chain requirements without a scramble.
Shared devices, joiners and leavers
Shift PCs and tablets set up for individual sign-in, new starters ready before day one, leavers closed down the same day, with a record of both.
What is not included, and why
- ERP, CAD and machine software licences. You buy those from the vendor or reseller; we make sure they run and are protected.
- Programming or repairing machine controllers. That stays with the machine builder; we protect the network around them and back up what can be backed up.
- On-call engineering outside office hours and the 24/7 Barracuda SOC are optional extras, priced separately.
What it costs
Managed IT support for manufacturers is priced per user per month, with security monitoring and device management included, so it moves with your headcount. Microsoft 365 or Google Workspace backup is a separate service, also priced per user per month. Licences are extra at Microsoft's or Google's price: Microsoft 365 Business Premium is £16.90 per user per month at Microsoft's UK price. Onboarding, network segregation, server or ERP migration work and Cyber Essentials certification are quoted as fixed projects. We quote after a short discovery call, once we know your setup.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Questions people ask before signing
Can you separate our machines from the office network without stopping production?
Yes. We survey what talks to what first, then move devices across in planned windows agreed with you, usually one cell or line at a time. Rules start permissive and are tightened once we can see the real traffic, so a machine does not lose its connection to the ERP or a file share overnight.
Our machine controllers run old Windows. Is that a problem?
It is a risk you manage rather than fix. Where the equipment maker will not support an upgrade, we isolate the controller, block internet access and unneeded USB use, and back up its configuration and programs. That is the approach the NCSC recommends for operational technology.
Do you support our ERP system?
We support systems such as Sage 200, SYSPRO, Epicor and Microsoft Dynamics 365 Business Central: the server, database, backups, remote access and client installs. Configuration of the ERP itself stays with your vendor or reseller, and we work with them when a problem crosses the line.
A customer wants Cyber Essentials before renewing our contract. How long does it take?
It depends on what needs fixing first, most often unsupported devices, missing MFA or admin rights on everyday accounts. We assess against the requirements, fix the gaps and then certify, as a fixed-price project quoted after a discovery call.
We do MOD subcontract work. What do we need?
Your contract will say: MOD contracts carry DEFCON 658 and a Cyber Risk Profile, and the requirements apply to subcontracts. We help you read what your profile asks for, put the technical controls in place and keep the evidence. Your prime contractor and your contract terms decide the level.
We run night shifts. What happens if something breaks at 3am?
Monitoring and patching run 24/7 and raise alerts to the helpdesk, which works Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00. Engineering cover outside those hours is an optional extra, not in the standard price, so if production depends on it, speak to the team and we will cost it with you.
We use Google Workspace, not Microsoft 365. Can you still help?
Yes. We support both and will not push you to switch. We enforce 2-Step Verification, set Gmail protection and Drive sharing controls, restrict third-party app access, manage your office and shop-floor PCs, and back up Gmail and Drive outside Google. Network segregation, ERP support and Cyber Essentials work the same on either platform.
How much does IT support cost for a manufacturer?
Managed support is priced per user per month with security included, so it moves with your headcount. What changes the figure is the number of users and devices, any servers, the security options you choose and any specialist software. Backup is a separate per user service, Microsoft 365 or Google Workspace licences are at Microsoft's or Google's price, and projects such as onboarding are quoted as fixed pieces of work. We quote after a short discovery call, once we know your setup.