Cybersecurity for Manufacturers in West Michigan
From CAD file protection to CMMC readiness, we help West Michigan manufacturers defend IP, pass prime-contractor cybersecurity audits, and keep production systems running.
Book a Free Manufacturing Security AssessmentWhy Manufacturers Are Under Cybersecurity Pressure Right Now
Ransomware groups have discovered that manufacturers are among the most lucrative targets available. Every hour a production line is down costs real money, in lost output, delayed shipments, broken customer commitments, and overtime to catch up. Attackers know this. The average manufacturing ransomware incident costs $1.5-$4M in downtime alone before any ransom is considered. Groups like LockBit, BlackCat, and Cl0p actively target manufacturers because the financial pressure to pay is acute and immediate.
Intellectual property theft is the second major pressure. State-sponsored actors, particularly from China, Russia, and Iran, systematically target manufacturers to steal CAD files, engineering specifications, proprietary process documentation, and product roadmaps. A SolidWorks assembly file exfiltrated overnight can be replicated by a foreign competitor in months. The FBI's most active counterintelligence cases in Michigan have involved manufacturing IP theft, particularly in the automotive supply chain and aerospace sectors.
Prime contractors are now pushing cybersecurity requirements down to their Tier 2 and Tier 3 suppliers with increasing aggression. The DoD's CMMC 2.0 rule, fully in effect for new contracts, requires suppliers handling Controlled Unclassified Information (CUI) to achieve CMMC Level 2 certification from a third-party assessor. Commercial primes in automotive, medical device, and aerospace are following with their own annual supplier security audits. Suppliers who can't demonstrate compliance are being removed from approved vendor lists.
Manufacturing is the most targeted industry for ransomware attacks, overtaking healthcare in 2024 (IBM X-Force)
Average manufacturing downtime cost per ransomware incident, before ransom payment
NIST 800-171 controls that CMMC Level 2 suppliers must implement and document
Year CMMC 2.0 became enforceable in new DoD contracts, suppliers without a plan are already behind
CMMC 2.0 Readiness for West Michigan DIB Suppliers
CMMC 2.0 uses a three-level model. Level 1 covers basic cyber hygiene for suppliers handling Federal Contract Information (FCI), 17 practices, self-assessed annually. Level 2 is the critical tier for most Michigan defense suppliers: it requires all 110 NIST SP 800-171 controls and, for contracts above certain thresholds, a third-party assessment by a Certified Third-Party Assessor Organization (C3PAO). Level 3 is reserved for the most sensitive programs and adds NIST 800-172 controls assessed by the Defense Contract Management Agency (DCMA).
Michigan has one of the deepest Defense Industrial Base footprints in the Midwest. General Dynamics Land Systems (GDLS) in Sterling Heights, Williams International in Pontiac, BAE Systems Land & Armaments in York Township, and dozens of Tier 2 and Tier 3 suppliers in the Grand Rapids, Holland, and Lansing corridors all sit within the DoD supply chain. If you make components, provide engineering services, or handle technical data for any of these primes, or their subs, CMMC is a live compliance obligation, not a future consideration.
Evolv cannot perform the C3PAO assessment itself, that role is reserved for CMMC-AB certified assessor organizations. What we do is build the program that passes it. We conduct a pre-assessment gap analysis, draft your System Security Plan (SSP) and Plan of Action & Milestones (POA&M), implement missing controls, and run a mock assessment before your C3PAO team arrives. For shops that need a named security officer to sign the SSP, we pair this engagement with our fractional CISO service, giving you executive-level security leadership without a full-time hire.
Annual self-assessment. No third-party audit required. Applies to all suppliers handling Federal Contract Information.
C3PAO assessment required for most CUI contracts. This is where the majority of Michigan DIB suppliers need to be.
DCMA-led assessment. Reserved for the most sensitive defense programs. Rare for small and mid-size suppliers.
IT and OT, Two Networks, One Security Strategy
Most manufacturing facilities have an invisible problem: the IT network (email, ERP, file servers) and the OT network (PLCs, HMIs, ICS/SCADA) have grown together over time without deliberate segmentation. ICS devices run unpatched Windows XP or Windows 7 because the machine vendor hasn't certified newer OS versions. HMIs are reachable from the office network, sometimes from the internet, because engineers configured remote access for convenience. No EDR runs on controllers because you can't install agents on a PLC. Equipment vendors have VPN credentials that haven't been rotated in years.
This convergence means a ransomware infection that starts in an office email can reach your production floor within hours. A phishing email opens a foothold on an engineer's laptop, and lateral movement tools traverse the flat network to a Windows-based HMI controlling your CNC line. We've seen this exact scenario play out at Michigan manufacturers. The outcome is a production shutdown that costs more per hour than any security investment would have.
The OT security baseline we build starts with network segmentation, a properly configured DMZ between IT and OT, firewall rules that allow only the specific communication flows production actually requires, and vendor remote access through a monitored jump host with MFA and session recording. Where data flows one-way (historian to ERP, for example), we implement one-way data diodes. OT-specific monitoring, using passive network visibility tools that don't inject traffic into control networks, gives us visibility into anomalies without triggering legitimate controller communications.
Security Services Built for Manufacturing
Every engagement is scoped to your production environment, supply chain obligations, and cybersecurity maturity.
CAD and Engineering File Protection
Secure access controls, DLP policies, and encryption for SolidWorks, AutoCAD, and PDM/PLM systems, protecting your IP from insider threats and external attackers.
CMMC 2.0 Readiness Assessment and SSP Authoring
Gap assessment against all 110 NIST 800-171 controls, System Security Plan drafting, Plan of Action and Milestones, and pre-assessment preparation for C3PAO review.
IT/OT Network Segmentation and Monitoring
Firewall segmentation between corporate and production networks, OT-aware monitoring that doesn't trigger on legitimate controller traffic, and vendor jump-host configuration.
Vendor and Supplier Access Governance
Zero-trust remote access for equipment vendors, MFA-gated jump hosts, session logging, and third-party access review procedures that satisfy CMMC and prime contractor requirements.
Ransomware-Resilient Backup and Recovery
Immutable, air-gapped backup architecture with documented RTO/RPO targets, tested quarterly so you can recover production systems without paying a ransom.
Incident Response Retainer with Manufacturing Playbooks
A pre-positioned IR retainer with manufacturing-specific playbooks covering production-floor impact assessment, OT system recovery sequencing, and regulatory notification procedures.
Cyber Insurance and Prime Contractor Audits
Cyber insurance underwriters have fundamentally changed how they assess manufacturers. In 2019, a manufacturer could get a policy with basic antivirus and a firewall. Today, carriers require documented attestation of MFA across all remote access and privileged accounts, EDR deployed on all endpoints, offline or immutable backups tested within the past 90 days, a written incident response plan with defined escalation paths, and vendor access governance controls. Missing any of these typically results in either coverage denial or exclusions that render the policy useless for the exact scenarios manufacturers face. 24/7 monitoring is increasingly listed as a preferred control that reduces premiums.
Prime contractor audits follow a similar checklist. Automotive, aerospace, and defense primes conducting annual supplier cybersecurity reviews want to see your SSP, evidence of MFA and EDR deployment, a recent backup test result, your incident response plan, and your vendor access log. Some primes now require a formal self-assessment score against NIST 800-171. Our incident response retainer and managed security program are specifically designed to produce the documentation package that satisfies both insurers and prime auditors, so you have one set of controls that answers both requirements simultaneously.
Related Services & Locations
Other industries we serve
Frequently Asked Questions
Do we need to be CMMC Level 2 certified to stay in our prime's supply chain?
It depends on whether you handle Controlled Unclassified Information (CUI). If your prime's contract involves CUI, technical drawings, specifications, or design data marked as CUI, then yes, CMMC Level 2 certification is required by the DoD rule that took effect in 2024. If you only handle Federal Contract Information (FCI) and no CUI, Level 1 self-assessment may be sufficient. The key step is reviewing your contracts and any associated DD-1423 or CUI markings with your prime to determine exactly what data flows to your shop.
What's the difference between NIST 800-171 and CMMC 2.0?
NIST SP 800-171 is the underlying control framework, 110 security requirements across 14 domains, published by NIST to protect CUI in non-federal systems. CMMC 2.0 (Cybersecurity Maturity Model Certification) is the DoD's enforcement mechanism for those requirements. CMMC Level 2 is essentially NIST 800-171 compliance plus a third-party assessment by a Certified Third-Party Assessor Organization (C3PAO). Put simply: NIST 800-171 defines what you need to do; CMMC 2.0 defines how the DoD verifies you've done it.
We make civilian products, do we still need cybersecurity beyond basic antivirus?
Yes. Even manufacturers with no defense contracts face significant cyber risk. Ransomware groups specifically target manufacturers because production downtime creates immediate pressure to pay. Cyber insurance now requires MFA, EDR, tested backups, and an incident response plan as baseline conditions for coverage, not antivirus alone. Additionally, many commercial supply chains (automotive, medical device, consumer goods) are beginning to push cybersecurity attestation requirements down to their Tier 2 and 3 suppliers, mirroring what the DoD did with CMMC.
How do you secure our shop floor without disrupting production?
OT security engagements begin with passive discovery, we map your ICS/SCADA environment, identify unpatched systems, and document network topology without touching production systems. Remediation is sequenced around scheduled maintenance windows. We don't install agents on PLCs or controllers; we use network-level monitoring that observes traffic passively. Segmentation changes are staged and tested in coordination with your operations team. The goal is always to improve security posture without generating a single production incident.
Can you help us pass our prime contractor's annual cybersecurity audit?
Yes. We prepare manufacturers for prime contractor cybersecurity assessments by building or hardening the required documentation: System Security Plan (SSP), Plan of Action and Milestones (POA&M), policies, and evidence packages. We conduct internal pre-assessments against the prime's specific questionnaire or assessment framework, whether that's their own audit criteria, NIST 800-171, or a CMMC Level 1 self-assessment. Primes typically want to see MFA, endpoint protection, encrypted backups, an IR plan, and vendor access controls. We make sure your evidence package is complete before their team arrives.
What does a CMMC readiness engagement typically look like for a 50-person shop?
For a 50-person manufacturer pursuing CMMC Level 2, a readiness engagement typically runs 3-6 months and covers: (1) a gap assessment against all 110 NIST 800-171 controls, (2) System Security Plan drafting, (3) Plan of Action and Milestones for any gaps, (4) control implementation across the 14 domains, access control, incident response, configuration management, media protection, and others, (5) evidence collection and documentation, and (6) a pre-assessment mock review to stress-test your posture before the C3PAO assessment. We pair this with our fractional vCISO engagement for shops that need a named security officer to sign the SSP.
Serving Manufacturers Across West Michigan
Evolv serves manufacturers across West Michigan and mid-Michigan , Grand Rapids (office furniture, medical devices, precision machining), Kalamazoo (pharmaceutical manufacturing, life sciences equipment), Holland (automotive Tier 2, metal fabrication), Muskegon (metal casting, foundry, industrial equipment), and Lansing (auto assembly adjacent, defense supply chain). Each location page details the on-site and remote security services available to manufacturers in that area.
Ready to Assess Your Manufacturing Security?
Book a free 30-minute scoping call. We'll review your CMMC obligations, OT environment, and prime contractor requirements, and give you a realistic roadmap to compliance.
Book a Free AssessmentLet's build something extraordinary
Schedule a free discovery call with our solution architects. No pressure, just a conversation about what's possible.