Medical Device Manufacturing Cybersecurity: Where Plant OT Security Meets Product Security

By Denrich Sananda 02-11-2026 6 min read

Medical device manufacturers carry two cybersecurity obligations that get discussed as if they were one. The first is product cybersecurity: the device itself, its firmware, its connectivity, and the regulatory submissions that go with it. The second is the security of the plant that builds the device, which is ordinary industrial OT security applied in an unusually unforgiving quality environment.

Most published guidance addresses the first. The second is where production actually stops. A compromise of a manufacturing execution system, a sterilization controller or an environmental monitoring system does not create a product vulnerability, it creates a batch you cannot release and a quality record you cannot defend. Our work in pharmaceutical manufacturing lines deals with the same problem, and the constraints transfer directly.

Two obligations, two owners, one gap

	What it covers
Product cybersecurity	The device as a connected product: firmware, interfaces, SBOM, vulnerability handling over the product lifetime, and the evidence regulators expect in submissions. Usually owned by R&D and regulatory affairs.
Manufacturing OT security	The plant that builds it: MES, PLCs and controllers, sterilization and autoclave systems, environmental monitoring, labeling and serialization, warehouse and distribution systems. Usually owned by nobody clearly.

That ownership gap is the finding we report most often. Product security has a team, a budget and a regulatory driver. The plant network frequently sits between corporate IT, who do not understand validated systems, and manufacturing engineering, who were never given a security remit.

What makes a device plant harder than an ordinary factory

Validated systems resist patching. A computerized system under validation cannot be patched casually, because the change may invalidate qualification. That is a real constraint, not an excuse, and it means compensating controls carry more weight than elsewhere.
Quality records are the product. If you cannot demonstrate the integrity of batch records, environmental data or sterilization cycles, the physical product may be sound and still unreleasable.
Sterilization and process controllers have safety consequences. These are not just production systems. An incorrect cycle is a patient safety issue, which brings the safety case into the security conversation.
Serialization and labeling are regulated and connected. Unique device identification ties plant systems to external databases, which creates outbound dependencies most plants have not mapped.
Distribution is tightly coupled. Device manufacturers ship to hospitals on short cycles. An order processing or warehouse outage reaches clinical customers within days.

The dependency that surprises boards

The system that stops shipments is rarely a controller. It is order processing, warehouse management or the labeling system that sits between production and the loading dock. A plant can be making product perfectly well and still ship nothing, because a label cannot be generated or a release cannot be recorded. Mapping which business systems production depends on, and which of those depend on production, is cheaper than any technology and it is the work most often skipped.

Where to start in a device plant

1. Inventory the plant, including the validated systems. You cannot protect or patch what is not on a list. See our guide to non-disruptive OT asset discovery.
2. Map the production-to-business dependencies in both directions. MES to ERP, labeling to serialization databases, quality systems to release.
3. Segment production from the enterprise. The single highest-value control. Our segmentation audit guide covers how to assess what you have.
4. Control removable media. Still a primary route into validated systems that cannot run modern endpoint tooling. See removable media security for OT.
5. Build detection before you need it. Passive monitoring across the production conduits, baselined over a real production cycle.
6. Test recovery against a quality scenario. Not "can we restore the server" but "can we release product afterwards".

Where IEC 62443 fits, and where it does not

For the plant, IEC 62443 is the right framework: zones and conduits, security levels, and a structure that maps onto a validated environment without fighting it. For the device as a product, 62443 is not the relevant standard and you will be working to medical device specific expectations instead. Keeping those two conversations separate saves a great deal of confusion in audits, because an auditor asking about product security will not be satisfied by plant network evidence, and the reverse is equally true.

Why Choose Arista Cyber

We secure the plant, not the product. That distinction matters and we state it plainly rather than claiming both. Our consultants work on validated manufacturing environments across medical device and pharmaceutical operations, hold functional safety credentials alongside OT security certification, and plan changes around qualification and outage windows rather than around a patch calendar. See our pharmaceutical and life sciences work and our case studies.

Next Steps

Start with the dependency map rather than a technology assessment. In device manufacturing the question that matters is which systems have to be working for product to leave the building, and most organizations cannot answer it on a whiteboard. Once you can, the security priorities order themselves.

Common Questions

Is medical device cybersecurity about the device or the factory?

Both, and they are separate programs. Product cybersecurity covers the device as a connected product and its regulatory submissions. Manufacturing OT security covers the plant that builds it. This article addresses the plant.

Can we patch validated manufacturing systems?

Not casually, because changes may affect qualification. That is why segmentation, access control, removable media control and monitoring carry more weight in a validated environment than patching does.

What usually stops shipments in a device plant?

More often a business system than a controller. Order processing, warehouse management or labeling failures can halt shipping while production itself is unaffected.

Does IEC 62443 apply to medical device manufacturing?

To the plant, yes, and it maps well onto validated environments. For the device as a product you will be working to medical device specific requirements instead.

Where should a device manufacturer start?

Asset inventory, then a two-way dependency map between production and business systems, then segmentation. Technology decisions come after those three.

Can you name every system that has to work for product to ship?

Arista Cyber assesses OT security in validated manufacturing environments: asset inventory, production-to-business dependency mapping, segmentation review and recovery testing against a quality release scenario.

Request a manufacturing OT assessment