Made Smarter Yorkshire has launched a £400,000 cyber security programme for small and medium-sized manufacturers, with fully funded training designed to move businesses from basic awareness through Cyber Essentials, Cyber Essentials Plus, and preparation for ISO 27001 certification.
The government-funded pilot is being delivered with Sheffield Hallam University and will begin with workshops in September. Its structure is deliberately progressive: manufacturers can enter at an introductory cyber-awareness level and, where they meet the requirements, move through more formal controls, technical assessment, and information-security management. The programme also aims to create Cyber Security Champions inside participating businesses so that responsibility does not sit solely with external consultants or a small IT team.
The introductory awareness session is open to eligible SME manufacturers in Yorkshire and the Humber without prior Made Smarter registration. Businesses moving into the subsequent levels must register with Made Smarter, while progression to Cyber Essentials Plus requires Cyber Essentials accreditation and the ISO 27001 level requires Cyber Essentials Plus. Delivery will combine online sessions, work at Sheffield Hallam University, and, for some advanced support, activity at manufacturers’ own premises.
Cyber risk has increased as smaller factories connect more production equipment, maintenance systems, cloud software, remote-access tools, sensors, and enterprise platforms. The resulting visibility and automation can improve control over production, but every additional connection introduces another system that has to be configured, maintained, monitored, and protected across its operating life.
Official UK figures show the exposure. The Cyber Security Breaches Survey 2025/2026 found that 43% of businesses had identified a cyber security breach or attack in the previous 12 months. The rate was 49% among the survey’s utilities or production grouping, which includes manufacturing, while medium and large businesses reported prevalence of 65% and 69% respectively.
Those figures cover identified incidents rather than every intrusion, and the survey cautions that some attacks go unnoticed or unreported. In a manufacturing environment, compromised credentials or poorly controlled remote access can interrupt administration and planning, but attacks reaching production networks can also stop equipment, disrupt material flow, delay despatches, or force a business to isolate systems while the extent of an incident is established.
The Made Smarter programme is structured around different levels of technical maturity rather than assuming every SME is ready for the same standard on day one. Cyber Essentials focuses on a defined set of baseline technical controls, Cyber Essentials Plus adds independent technical verification, and ISO 27001 requires a broader information security management system covering governance, risk assessment, documented controls, audit preparation, and continual improvement.
Certification can also become a supply-chain requirement. Customers in aerospace, defence, automotive, medical, and other regulated or high-value sectors increasingly ask suppliers to demonstrate how they protect systems and data, turning cyber controls into part of commercial qualification as well as internal risk management.
Made Smarter Yorkshire already provides digital roadmaps, specialist advice, leadership support, internships, and, where appropriate, grants towards technology adoption. Similar support is being used for projects such as WAWWA’s £120,000 digital production programme, where CAD/CAM, automated cutting, and production planning are replacing more manual processes. As factory systems become more connected, digital adoption and cyber discipline increasingly have to develop together.
The programme’s emphasis on internal champions is practical because many vulnerabilities arise from ordinary operating decisions: unmanaged accounts, weak authentication, unpatched devices, unnecessary administrator rights, poorly controlled suppliers, or remote access left in place after a service visit. These are routine governance failures rather than exotic attack methods, and they are easier to prevent when responsibilities are understood across the business instead of being revisited only during an annual compliance exercise.
Manufacturers progressing to the more advanced levels will receive tailored coaching as they prepare systems, devices, networks, and management processes for assessment. That creates a measurable progression from workshop attendance towards controls that can be tested, audited, and demonstrated to customers. The lasting result will depend on whether those controls remain maintained after the funded support ends.
The first workshops begin in September, moving the £400,000 pilot into delivery. The funding lowers the immediate cost of improving cyber maturity, but certification is only a snapshot unless the associated controls survive changes in staff, machinery, suppliers, software, and remote access. Factory cyber security becomes operational when those controls are treated with the same routine discipline as maintenance, quality, and safety.
