Insurers, OEM customers, and primes all want artifacts. A spreadsheet from the last audit isn’t one. Nobody from a federal agency is going to walk into your plant and ask about network segmentation. The pressure on mid-size manufacturers to prove what’s on their network is commercial, and it arrives from three directions: your insurance renewal, your largest customer’s procurement team, and – if you do defense-adjacent work – the flow-down clause in your prime’s contract. All three have converged on the same demand, and it isn’t a policy document. It’s evidence. Here are the actual questions, in the order you’ll meet them.

Who’s Asking, and What They Want to See

1. The Underwriter at Renewal

Cyber insurance underwriting has become a technical audit. Carriers increasingly run an external scan of your environment before quoting, and ask for artifacts rather than attestations – identity provider screenshots, endpoint coverage reports, restore-test logs with dates – because overstating a control on an application can void the policy you’re buying.

The questions that touch access control directly: Do you maintain an inventory of all devices connected to your network, and how is it kept current? Is there documented segmentation between Information Technology (IT) and Operational Technology (OT) networks? Can unmanaged or unknown devices connect to production segments? Is remote access to plant systems brokered through Multi-Factor Authentication (MFA)? Are vendor accounts inventoried, time-bound, and individually attributable?

Controls sort into three tiers. Some are pass-fail: MFA, Endpoint Detection and Response (EDR), and tested immutable backups, with roughly 80% of insurers requiring MFA and 65% requiring EDR. Some rate you up when they’re weak. And a handful earn credits – among them documented OT/IT segmentation, the production floor kept apart from email and file servers, which underwriters treat as a direct measure of whether ransomware can traverse from one segment and encrypt everything at once.

S&P Global Ratings projects global cyber insurance premiums will grow 15%–20% annually, reaching approximately $23 billion by the end of 2026. A weak answer rarely means outright declination; more often it means a sub-limit capping payout on the ransomware coverage you bought the policy for, a higher retention (the share you absorb before coverage starts), or a renewal that stalls while you assemble documentation you don’t have.

Your renewal is now an audit, and the failure mode is a coverage gap you don’t discover until you claim.

2. The OEM Customer’s Security Questionnaire

If you supply a tier-one or an Original Equipment Manufacturer (OEM) directly, you already know this document. What’s changed is that it gates the contract rather than accompanying it, and the sections that fail most often are the ones about devices nobody manages.

The recurring categories: unmanaged device visibility on production networks. Third-party and contractor access, who has it, scoped to what, revoked when. Segmentation between business systems and production systems. Incident notification timelines to the customer. And evidence of who authorized any given device or account to be where it is.

That last one is where the wheels come off. A supplier can answer “yes, we control network access” honestly and still fail, because the follow-up asks for the access list and the approval record. The questionnaire isn’t testing whether you have controls. It’s testing whether you can produce the record.

3. CMMC, and What the July 2026 Suspension Did and Didn’t Change

For defense-adjacent work, the Cybersecurity Maturity Model Certification (CMMC) is a contract gate rather than a regulation: no certification at the required level, no award. The mechanism changed materially this summer, and a lot of manufacturers have misread it.

On July 13, 2026, the Department of War suspended CMMC Phase 2 – the transition, scheduled for November 10, 2026, that would have required assessment at Level 2 by an accredited outside auditor, a C3PAO, as a condition of award – and placed pending implementation milestones in abeyance pending a 60-day review by a new CMMC Reform Task Force. The memo cited prohibitive compliance costs and a severe shortage of assessment capacity.

What did not change: Phase 1 self-assessment requirements remain in force, the scores you post to the government’s Supplier Performance Risk System still carry False Claims Act exposure, and DFARS clause 252.204-7012 still contractually requires implementation of NIST SP 800-171 independent of CMMC. Counsel at multiple firms has made the same point – this is a pause on the verification mechanism, not a repeal of the standard. If anything, suspending third-party assessment shifts the signature risk onto you.

There’s also a scoping problem that predates all of this: many manufacturers don’t know whether they’re in scope until a prime tells them, usually in a flow-down clause attached to an award they’ve already won. The assessment schedule moved. Your liability for what you assert did not.

Policy Is Not Evidence

The thread running through all three: each is asking manufacturers to prove what’s on their network, not describe it in a policy document.

A written access-control policy says what should happen. An underwriter, an OEM procurement team, and a prime’s flow-down auditor are asking something narrower – show me the current list of devices on your production network, show me who approved each one, show me when the last vendor account was revoked and by whom. A spreadsheet updated at the last audit answers none of these, because its accuracy expired the day after it was written.

If producing the artifact requires a project, you don’t have the control. You have a description of one.

Try to Produce the Artifacts

Take the questions above into your next renewal meeting as a checklist. For each one, try to produce the artifact in under an hour without asking anyone to build something. Where you can’t, note whether the gap is the control itself or just the record of it – different problems, different price tags. Then run the same exercise against your largest customer’s most recent questionnaire. The overlap between the two lists is your real priority order, and your counterparties set it, not you.

Three Askers, One Answer: Prove What’s on Their Network

An underwriter, an OEM customer, and a prime contractor have arrived at the same demand from completely different motives. All three want you to prove what’s on your network and prove what it’s allowed to reach – continuously, with a record, not as of the last audit. The manufacturers who handle this well aren’t the ones with the thickest policy binder. They’re the ones who can answer in the meeting.

Portnox produces that record as a by-product of enforcement rather than as a separate exercise: a live inventory of every connected endpoint, including unmanaged and OT devices, the policy that governed each admission, and a log of what was allowed and what wasn’t. When the questionnaire asks for evidence, the evidence already exists.