Article
Backups aren't the same as recovery
Having backup files isn't the same as being able to recover from a disaster. Here's the difference, and how to close the gap.
- PROTECT
6 min ·
INDUSTRY / MANUFACTURING
One good quote can win the order. One bad network can shut down the line.
Your plant floor runs on machines that have been reliable for years, your office runs quotes and purchase orders, and vendors need remote access to keep equipment running. Cyber6 helps you turn quotes into orders faster, keep the floor separated from the risks that come in through email and vendor logins, and get your team ready for customer security audits.
AUTOMATEPROTECTEMPOWER
6 min read
shop floor with CNC machines running next to an office window with a quote on screen
Example
Plant network check
- Office networkSegmented(OK)
- Plant floor networkSeparated from office(OK)
- Vendor remote accessLogged and time-limited(OK)
- CNC controller OSWindows 7, isolated(Needs attention)
WE GET IT
We know what your week looks like
- 01
A machine goes down and the line stops
Production halts while someone finds the vendor's remote access tool, and nobody remembers whose login it was or whether it's still active.
- 02
The plant floor and the office share one network
The same network that runs email and accounting also talks to the machines running your production line. A phishing email in the office is one step from the floor.
- 03
Quotes sit in someone's inbox
An estimator builds a quote by hand from a spreadsheet template. It sits for two days before it goes out, and the customer has already called a competitor.
- 04
Order-to-cash takes weeks
A completed order waits on paperwork, sign-off, and manual invoice entry before anyone bills for it. Cash sits on the floor instead of in the bank.
- 05
Vendor remote access nobody reviews
Equipment vendors and integrators have standing remote access from years ago. No one has checked whether they still need it or who is using it.
- 06
The controller running old Windows
A CNC machine or PLC runs a version of Windows the vendor stopped patching years ago, because replacing it means replacing the machine.
- 07
A customer sends a security questionnaire
A new defense or automotive customer sends a CMMC or supplier security questionnaire with a deadline, and nobody in the shop has answered one before.
- 08
Documentation nobody has time to write
Work instructions, quality records, and compliance evidence live in someone's head or a filing cabinet, not somewhere an auditor or new hire can find them.
THE IMPACT
What it's costing you
Orders you're slow to win
A quote that takes days instead of hours loses jobs to a competitor who answered first, even if your price and quality are better.
Cash tied up in finished orders
Every day between shipping and invoicing is a day your cash sits on the floor instead of funding the next job.
A stopped line
Ransomware or a compromised vendor login can shut down production for days, with orders backing up behind it.
Lost contracts over paperwork
Defense and larger manufacturing customers require documented security. Missing it can disqualify you from bids you're otherwise qualified for.
Time spent firefighting instead of building
Staff spend hours chasing quotes, re-entering data, and manually pulling reports instead of running the shop.
COMPLIANCE
Rules you have to follow
CMMC (Cybersecurity Maturity Model Certification)
- What it is
- A Department of Defense requirement for security practices, built on NIST 800-171.
- Who it applies to
- Manufacturers and machine shops that work in the defense supply chain, directly or as a subcontractor.
- What it expects of you
- Documented security controls covering access, monitoring, and incident response, assessed at a level matching your contracts.
- How Cyber6 helps
- We run a CMMC gap assessment, close the gaps, and build the documentation an assessor or prime contractor will ask for.
NIST 800-171 and DFARS 252.204-7012
- What it is
- The federal standard for protecting controlled unclassified information, and the defense contract clause that requires it.
- Who it applies to
- Any contractor handling controlled unclassified information on a defense contract.
- What it expects of you
- Specific technical and administrative controls, plus reporting cyber incidents to the Department of Defense within required timeframes.
- How Cyber6 helps
- We map your environment against the control set and build the incident reporting process you'd need to use.
ITAR (International Traffic in Arms Regulations)
- What it is
- Export control rules for defense-related technical data.
- Who it applies to
- Manufacturers working with controlled technical data covered by ITAR. [OWNER: confirm which clients this applies to.]
- What it expects of you
- Controls on who can access covered data, including preventing access by non-U.S. persons in many cases.
- How Cyber6 helps
- We help configure access controls and document who can see what, alongside your export control counsel.
Customer security audits
- What it is
- Security questionnaires and audits required by larger customers before they'll place orders.
- Who it applies to
- Any shop selling to automotive, aerospace, defense, or other customers with formal supplier requirements.
- What it expects of you
- Evidence of security practices, sometimes a formal certification or attestation.
- How Cyber6 helps
- We prepare the documentation and evidence so a questionnaire doesn't turn into a scramble.
This is general information, not legal advice.
THE FIX
How Cyber6 helps
AUTOMATE
Fill the gaps automatically
- Get found
The right customers find you on Google, AI search, and social, in your own voice.
- Get customers
Every call, text, form, and quote turns into booked work.
- Serve customers
Customers hear from you at the right time, without your team chasing them.
- Get paid
Money you've already earned comes in sooner, without awkward phone calls.
- Run the business
Less retyping and waiting, more time for the work that matters.
Quote-to-order
Pricing, specs, and terms populate automatically from your standard data, and the quote goes out the same day it's requested.
Order-to-cash
Completed orders trigger an invoice automatically, with the paperwork attached, so billing happens the day the job is done.
Documentation assistants
A documentation assistant drafts and organizes work instructions and compliance records from what your team already does, ready for review.
PROTECT
Protect what you're trusted with
- 01
Plant floor network separation
We put your production machines on their own network segment, separate from office email and general internet use, with controlled points between them.
What this means for you: A phishing email in the office can't reach the machines running your line.
- 02
Secure vendor remote access
We replace standing, shared remote access with logged, time-limited sessions that vendors request when they need them.
What this means for you: You know exactly who is on your network, when, and why, instead of trusting a login that's been open for years.
- 03
Endpoint protection and patching
We deploy and office and plant systems on a schedule, isolating machines and controllers that can't be updated.
What this means for you: An old CNC controller stops being the easiest way into your network.
- 04
Backups kept off your network
Production and business system data is backed up on a schedule and stored where ransomware on your network can't reach it, and we test that it restores.
What this means for you: A ransomware attack doesn't mean rebuilding your order history and specs from scratch.
- 05
CMMC gap assessment
We compare your current environment against the CMMC and NIST 800-171 control set and give you a prioritized list of what to fix, in order of what matters most for your certification level.
What this means for you: You know exactly what stands between you and passing a customer or government assessment.
EMPOWER
Train the people doing the work
Machine operators and floor supervisors
Floor security awareness
Short, practical training on shared logins, USB drives, and what to do if a machine behaves unexpectedly.
Estimators, purchasing, and accounting
Office and estimating team training
How vendor payment fraud and fake purchase order emails work, and a habit of verifying before wiring money or changing supplier details.
Estimators and quality staff
Safe AI use for quoting and documentation
What customer specs and pricing information can and can't go into AI tools, so you get the speed without leaking data covered by a customer contract.
A DAY WITH CYBER6
A day on your shop floor with Cyber6
6:30 AMAUTOMATE
Overnight quote requests are already priced and sent, waiting in the customer's inbox before your estimator arrives.
10:00 AMPROTECT
A vendor requests remote access to troubleshoot a machine. The session is approved, logged, and closes automatically when they're done.
1:30 PMEMPOWER
A purchasing clerk gets an email asking to change a supplier's bank details. She recognizes the pattern from training and calls the vendor directly to confirm.
4:00 PMAUTOMATE
An order shipped this morning is already invoiced, paperwork attached, without anyone re-typing the numbers.
YOUR TOOLS
Systems we commonly see
- Epicor
- JobBOSS
- SAP Business One
- Plex
We work alongside the systems you already use. We'll confirm what connects during your assessment.
QUESTIONS
Questions from manufacturing
We work alongside the major manufacturing ERP and shop floor systems and confirm exactly what connects during the assessment.
It depends on your contracts and what level of information you handle. We help you figure out what applies before you spend on a full certification effort.
It's common in this industry. We isolate them on their own network segment with monitoring, so they aren't an easy way in even though they can't be patched.
No. The machines and office systems that need to talk to each other still can. We control the path between them, not the work itself.
Yes. We can work alongside them on security and automation, or take over fully, and we coordinate so nothing falls between the two of you.
It depends on your size and current documentation, but we give you a clear timeline and a prioritized list before we start any work.
We help configure the technical access controls. We recommend working alongside your export control counsel for the legal determinations.
RESOURCES
Learn more
ArticleCMMC in plain English for small defense contractors
CMMC can sound like alphabet soup. Here is what Level 1 and Level 2 actually require, and where a small contractor should start.
- PROTECT
6 min ·
ArticleWhat your cyber insurance company will ask you, and how to get ready
Cyber insurance applications ask detailed questions about your controls. Here is what to expect and how to answer accurately.
- PROTECT
6 min ·
WHO WE'VE WORKED WITH
- A statewide cybersecurity assessment program
- Credit unions
- A water and wastewater utility
- Housing organizations
- Nonprofits and churches
- Small businesses
- A health and wellness startup
Every result is measured against your own starting point.
How we prove it →PART OF ONE PARTNER
One partner for all three.
Protect · IT & Cybersecurity
IT and cybersecurity, managed around the clock.
You're here
Empower · Training for Businesses & Individuals
Training that builds skills for your team and your career.
Explore Empower
WHY CYBER6
Why businesses choose Cyber6.
One partner, not three vendors
The people automating your work also run and protect your IT and train your team, so nothing falls between companies.
Plain language and real people
You talk to people who explain things clearly, answer the phone, and tell you what they'd do in your place.
Measured against your own numbers
We record where you start before anything changes, then report results against that baseline.
Marquis Carroll, Founder & CEO. Marquis has spent years doing hands-on IT and security work through his own business, and runs a mentorship program that has helped people start careers in tech.
Our storyGETTING STARTED
Four steps from first call to results.
Explore
A relaxed 30-minute conversation about how your business runs and what's getting in the way. No cost, no pressure.
You get: honest answers on whether we can help.
Assess
We look at your systems, security, manual work, and training needs, and record your starting numbers.
You get: a plain-English picture of your risks and opportunities.
Set up
A prioritized plan and proposal, then a kickoff that introduces your team and sets up access safely.
You get: a shared timeline and who to call for what.
Enable
We roll out in phases, train your team, and walk you through your first results.
You get: your first plain-English report, measured with PROVE.
Let's look at your shop floor together.
A 30-minute call. No cost, no pressure, and honest answers.