Cyber insurance for manufacturers: what carriers are actually asking now.

A manufacturer's network isn't just office computers. It includes programmable logic controllers, SCADA systems, robotics, IoT sensors, and connected equipment. Much of it running older operating systems that can't be patched the way a laptop can.

Carriers now ask specifically whether the office network and the operational technology network are segmented. An attacker who compromises an office workstation through a phishing email shouldn't have a path to the equipment running the floor. Most manufacturers built their networks before that boundary was a deliberate design decision, which means the segmentation either doesn't exist or was never verified.

This connects directly to a real claim pattern carriers have seen: ransomware deployed through compromised vendor portal credentials, encrypting the production network on a weekend when nobody was watching. The entry point wasn't the plant floor. It was a vendor relationship that had standing access nobody had reviewed.

Human error is involved in the overwhelming majority of cyber incidents, which is why carriers ask about training and phishing simulations. Most manufacturers have some version of this. A video new hires watch once, a poster in the break room.

Here's where this becomes a real problem, not just a compliance gap. Most applications ask you to attest that security awareness training is in place and conducted regularly. If you check that box without an actual program, without records of who completed it, when, and what the phishing simulation results showed, you haven't just left a gap in your security posture. You've made a representation to the carrier that isn't true. If a breach happens and the claim gets investigated, that gap between what you attested and what actually existed becomes the carrier's basis for denial. The absence of training is a security problem. A false attestation about training is an insurance problem, and a worse one.

This is the point that matters more than any individual control. The application isn't a marketing questionnaire. It's a representation the carrier prices the policy against and relies on if a claim comes in.

You can't attest to controls you don't actually have and expect the policy to perform the way you think it will. If the application says MFA is enforced across all remote access and ERP portals, and the reality is it's enforced on email but not on the ERP system vendors use to connect, that gap is exactly what an underwriter looks for during a claims investigation. Carriers increasingly ask for screenshots, configuration exports, and documented evidence instead of accepting a checked box. Because self-attestation that doesn't match reality has become a primary reason claims get denied, independent of whether the breach itself was preventable.

The honest version of this: figure out what's actually in place before you fill out the application, not after. If the answer to a question is partially true, the application should reflect that, and the gap should get closed before renewal. Not papered over with a yes.

The application gets answered from documentation, not memory. Every control attested to actually exists and can be evidenced if a claim is ever reviewed. The OT and IT networks are segmented with a tested boundary. Vendor access is reviewed instead of assumed safe. Training has records behind it. Sublimits are understood before a renewal, not discovered during a claim.

A business managed to CIS Controls, the framework we align to, produces most of this as a byproduct of how the environment runs, not as a scramble before an application is due. The renewal becomes a documentation exercise instead of a gap-closing project, and the attestation reflects what's actually true.

If you're not confident your current attestation matches your actual environment, or you've never reviewed what your sublimits actually cover, that's exactly what an IT Environment Review is for.