Ransomware in industry: how to prepare a production plant

Why ransomware is a production problem, not only an IT problem

According to the CERT Polska annual report for 2025, among 3 438 malware incidents there were 179 ransomware cases, about 5% of that category. The figure looks modest against 260 783 registered incidents overall, but its weight depends on the victim: in an industrial plant a single successful attack halts the issuing of orders, process control or quality documentation.

The same statistics show that the manufacturing sector appears in the classification of incidents handled by CSIRT NASK (93 events in 2025, table A6 of the report). This is data on reported cases, so the real scale is larger. For a plant director the conclusion is practical: the question is not whether to prepare for system encryption, but how long the plant can last without those systems.

What follows from NIS2 and the Polish KSC Act

Article 21 of Directive (EU) 2022/2555 requires risk-management measures, including incident handling, business continuity (including backup management and disaster recovery), supply chain security and access control with multi-factor authentication. Poland transposed the Directive with the Act of 23 January 2026 (Journal of Laws 2026, item 252) amending the National Cybersecurity System Act (KSC), which has applied since 3 April 2026.

The reporting deadlines are firm. An early warning must be sent without undue delay and no later than 24 hours after detecting a significant incident, an incident notification within 72 hours and a final report within a month of the notification. Reports go through the S46 system to the competent CSIRT.

A transition period is running: entities meeting the conditions on the day the Act entered into force have until 3 April 2027 to meet the obligations of chapter 3 of the Act (information security management system, documentation, incident procedures, contact persons). Financial penalties, apart from the most serious infringements, can be imposed only from 3 April 2028. For an essential entity the upper limit is EUR 10m or 2% of turnover (whichever is higher), and the head of the entity is responsible for oversight of the system. Legal position as of November 2026; the provisions on high-risk vendors are the subject of a motion to the Constitutional Tribunal.

Attack scenarios for an industrial plant

A response plan needs concrete scenarios, because each requires a different decision in the first hour.

Scenario 1: encryption of the office network and IT servers

Production planning systems, the warehouse, email and documentation are encrypted. The lines often keep running for a while, but work orders, labels and shipping documents run out. The key question: does segmentation protect the OT network, and for how many hours can the plant operate on its stock of data.

Scenario 2: encryption of SCADA and HMI stations

The operator loses visualisation and the process archive, although the controllers may still execute their program. Working without a view is risky, so you usually have to switch to manual control or shut the installation down in a controlled way. This requires a procedure described in advance, not improvisation.

Scenario 3: entry through remote access

In 2025 CERT Polska monitored 8 367 unique OT hosts visible from the internet. Typical vectors in Polish incidents are a private APN treated as a trusted network, open VNC services and default passwords. Attackers do not need advanced exploits: weak remote access and a lack of segmentation are enough.

Scenario 4: data theft and extortion without encryption

Some groups first exfiltrate data, then encrypt, and when backups work they threaten to publish. A backup then does not solve the disclosure problem, so the plan must include an assessment of what data left and the notifications required under separate regulations.

Preparing the plant in eight steps

The order matters: first knowledge of what the plant owns, then recovery, and exercises last.

• Inventory of OT and IT assets: controllers, engineering stations, servers, software versions, business owners.
• Business impact analysis (BIA): how many hours each system can be unavailable before production or quality stops.
• Network segmentation into zones and conduits following the logic of IEC 62443-3-2, with traffic control between IT and OT.
• Remote access control: separate accounts for IT, OT engineering and vendors, multi-factor authentication, a register of external access.
• Backups following the 3-2-1 rule, with an offline copy and copies of controller configurations, plus a regular restore test.
• Incident response plan: roles, contacts, criteria for classifying an incident as significant, templates for CSIRT reports.
• Emergency operating mode: paper and manual procedures for key operations, including permits for hazardous work.
• A tabletop exercise once a year and a restore test every quarter, with a record and a list of corrections.

Response plan: the first hours and reporting deadlines

A response plan should fit on two pages and be available without the plant network, that is printed and in an encrypted offline copy. The event starts a clock: the 24 hours for the early warning run from detecting a significant incident, so recording the time of detection is the first piece of evidence.

• First hour: isolate segments, cut remote access, and the operations manager decides the operating mode (manual, controlled shutdown, running on stock).
• Within 4 hours: set up the incident team, assess scope, preserve evidence (disk images, logs), contact the CSIRT and vendors.
• Within 24 hours: early warning through S46, if the incident meets the criteria of a significant incident.
• Within 72 hours: incident notification with an impact assessment and indicators of compromise.
• Within a month of the notification: final report with the cause, corrective actions and conclusions.

Audit evidence before and after the event

An auditor does not assess declarations, only traces. The first cybersecurity audit of essential entities is planned 24 months after the Act enters into force, that is from April 2028, but it is worth building the documentation now, because backups and exercises can only be proven from the date they were carried out. The set below supports meeting the requirement of Art. 21 NIS2 and provides evidence for an audit; it does not replace legal advice.

• Backup policy and restore test records with dates, times and results.
• BIA result with agreed RTO and RPO for critical systems.
• Diagram of zones and conduits and a list of exceptions with justification.
• Register of external and subcontractor access to OT zones.
• Response plan with a contact list and confirmation of training for the people responsible.
• Tabletop exercise record and a register of completed corrective actions.
• Documentation of the head of the entity's decisions on security measures and budget.

The most common preparation mistakes

The first mistake is a backup that nobody has restored: only a test shows that passwords, licences or an engineering station image are missing. The second is a backup reachable from the same domain as the production servers, which ransomware encrypts along with everything else. The third is a response plan written by IT without input from operations, so it ignores the real decisions about shutting down the installation.

The fourth mistake concerns paper processes: when the permit system for hazardous work is unavailable, the plant must have forms ready and a rule on who approves them. As with access registers, the paper trail must later be entered into the system so that documentation stays consistent. InnerWeb provides software in which the plant has a live view of who is doing what work and where, but a plan B without that system should always be described.