--- title: Why secure software development is the first line of defense against OT supply chain attacks description: Attackers are weaponizing the software supply chain to achieve maximum impact with minimum effort. For operational technology (OT) environments, the risk involved with a cyberattack is extremely high. Without assurance that suppliers follow rigorous secure software development life cycle (SSDLC) practices, manufacturers inherit risks that no network segmentation or air gapping can fully eliminate. canonical_url: https://www.acronis.com/en/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Why secure software development is the first line of defense against OT supply chain attacks Attackers are weaponizing the software supply chain to achieve maximum impact with minimum effort. For operational technology (OT) environments, the risk involved with a cyberattack is extremely high. Without assurance that suppliers follow rigorous secure software development life cycle (SSDLC) practices, manufacturers inherit risks that no network segmentation or air gapping can fully eliminate. [Try now](https://www.acronis.com/en/products/cyber-protect-ot/trial/) [![Image 2: Lee Pender](https://staticfiles.acronis.com/images/content/96b4b6d9ceee3c624b79f42543d1d633.png)](https://www.acronis.com/en/blog/authors/lee-pender/ "Lee Pender") [Lee Pender,](https://www.acronis.com/en/blog/authors/lee-pender/)Senior Content Marketing Manager 3 min read Last updated 14 November 2025 Other languages available:[Deutsch](https://www.acronis.com/de/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/) [Español](https://www.acronis.com/es/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/) [Français](https://www.acronis.com/fr/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/) [Italiano](https://www.acronis.com/it/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/) [日本語](https://www.acronis.com/ja/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/) [Português](https://www.acronis.com/pt/blog/posts/why-secure-software-development-must-be-the-first-line-of-defense-against-ot-supply-chain-attacks/) When Jaguar Land Rover's production lines [came to a complete halt](https://www.acronis.com/en/blog/posts/the-jaguar-land-rover-cyberattack-a-manufacturing-nightmare-that-could-strike-anyone/) on September 1, 2025, the financial toll was immediate and staggering: nearly $67 million per week in direct losses, with estimates of the total economic impact [reaching $2.8 billion](https://www.scworld.com/news/jaguar-land-rover-ransomware-attack-had-28b-economic-impact-in-uk). But the true damage extended far beyond the automaker's balance sheet. The shutdown rippled through JLR's sprawling supply chain of 104,000 workers. [Suppliers laid off staff](https://www.bbc.com/news/articles/c4gk01g2e36o) due to the attack, and the UK government stepped in with a guaranteed loan [exceeding $2 billion](https://www.bbc.com/news/articles/cgl15ykerlro). The JLR attack was part of a troubling pattern: Attackers aren't just targeting individual companies anymore. They're weaponizing the supply chain to achieve maximum impact with minimum effort. One way attackers gain entry is by targeting the development tools and processes for software applications that manufacturers and their supply chain partners use. If you’re not vigilant about making sure software providers use secure development practices, you’re leaving your organization open to the type of attack JLR suffered. [![Image 3: Why the Secure Software Development Life Cycle (SSDLC) must be a key criterion in supply chain evaluations](https://staticfiles.acronis.com/images/content/81c57cd166a62390813370b4601962ec.png) White paper Why the Secure Software Development Life Cycle (SSDLC) must be a key criterion in supply chain evaluations Get the white paper](https://www.acronis.com/en/resource-center/resource/why-ssdlc-must-be-a-key-criterion-in-supply-chain-evaluations/) ## The hidden vulnerability in your supply chain For operational technology (OT) environments in manufacturing, energy, transportation or critical infrastructure, the risk involved with a cyberattack is extremely high. An attack doesn't just compromise data in OT environments; it brings entire production ecosystems to a standstill, with downtime costs that can reach hundreds of thousands of dollars per hour. Still, most organizations focus their procurement evaluations on financial health, service-level agreements and infrastructure security. Yet many overlook the point where vulnerabilities are most often introduced — the software development process itself. For instance, Infostealer malware enables attackers to exploit years-old credentials, gaining access to manufacturers’ supply chain systems. This reveals a fundamental weakness not in perimeter defenses but in the secure development lifecycle practices of the software suppliers that power modern industrial operations. Their systems are vulnerable because they weren’t built to withstand modern cyberthreats — and that makes manufacturers’ OT systems vulnerable, too. ## Why business continuity depends on secure development Without assurance that suppliers follow rigorous secure software development life cycle (SSDLC) practices, manufacturers inherit risks that no network segmentation or air gapping can fully eliminate. The business impact is measurable and severe: * **Operational downtime**: Production halts cascade through just-in-time supply chains, affecting thousands of workers and disrupting delivery commitments. * **Financial losses**: Beyond direct revenue losses, recovery costs include incident response, system restoration, regulatory fines and potential contract penalties. * **Compliance violations**: Regulations like the EU's NIS 2 Directive, DORA and the Cyber Resilience Act now explicitly require secure development practices from suppliers. * **Reputational damage**: For suppliers, being the "weak link" in a supply chain breach can permanently damage customer trust and lead to disqualification from future partnerships. But this is more than just checking compliance boxes. It's about ensuring that the software controlling your production lines, managing your critical systems and connecting your industrial operations has security embedded from the first line of code to final deployment. ## Why IEC 62443-4-1 certification matters for your supply chain The IEC 62443 family of standards specifically addresses industrial automation and control systems security. Within this framework, IEC 62443-4-1 focuses exclusively on secure product development lifecycle requirements, providing the most rigorous and relevant standard for evaluating OT software suppliers. Unlike general information security frameworks, IEC 62443-4-1 certification demonstrates that a supplier has implemented: * **Security by design**: Security requirements are defined and threats modeled before any code is written. * **Secure coding practices**: Developers are trained and code undergoes mandatory review and automated security testing. * **Dependency management**: Third-party components are vetted, tracked and maintained through Software Bill of Materials (SBOM) practices. * **Secure release pipelines**: Updates are signed, integrity-checked and delivered through hardened channels. * **Vulnerability management**: Coordinated disclosure processes and defined response timelines for security issues. For OEMs, system integrators and end customers in manufacturing and critical infrastructure, this certification provides concrete, independently verified evidence that software suppliers aren’t just promising security. They are systematically engineering it into every product. ## Acronis: Certified security for OT cyber resilience Acronis has achieved IEC 62443-4-1 certification, alongside ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and CSA STAR Level 2 — demonstrating a comprehensive commitment to secure development practices across both IT and OT environments. This certification confirms that [Acronis Cyber Protect for OT](https://www.acronis.com/en/industries/backup/manufacturing/) — and the broader Acronis portfolio — are built using rigorous, independently verified security practices designed for the realities of industrial environments: * Protection for both IT and OT systems under a unified platform. * Backup and recovery capabilities that can scale across global operations without requiring manual, site-by-site interventions. * Security controls designed for environments where uptime is critical and traditional patching windows may be limited. * Compliance support for organizations navigating NIS 2, DORA, IEC 62443 and sector-specific regulations. ## Take action: Download the white paper A [new white paper](https://www.acronis.com/en/resource-center/resource/why-ssdlc-must-be-a-key-criterion-in-supply-chain-evaluations/), **"Why the Secure Software Development Life Cycle (SSDLC) must be a key criterion in supply chain evaluations,"** provides: * **Detailed analysis** of how supply chain attacks exploit development weaknesses. * **Practical evaluation criteria** for assessing supplier SSDLC maturity. * **A comprehensive checklist** (Appendix A) for use in procurement and audits. * **Mapping to international standards** including IEC 62443-4-1, ISO/IEC 27001, NIS 2, DORA and the Cyber Resilience Act. The paper draws from Acronis's own certification journey and provides actionable guidance for: * **Corporate end-customers** evaluating OT suppliers. * **OEMs** that need to demonstrate secure development to their customers. * **System integrators** building resilient industrial solutions. [Download the white paper](https://www.acronis.com/en/resource-center/resource/why-ssdlc-must-be-a-key-criterion-in-supply-chain-evaluations/)to learn how to move your supply chain security from reactive defense to proactive, standards-based assurance. [Operational Technology (OT)](https://www.acronis.com/en/blog/tags/operational-technology/) ## Written by ![Image 4: Lee Pender](https://staticfiles.acronis.com/images/content/96b4b6d9ceee3c624b79f42543d1d633.png) Lee Pender Senior Content Marketing Manager Lee was a journalist in the technology industry for 15 years, writing for and managing publications that served both IT and partner audiences. His experience as a corporate content creator includes tenures with an MSP and a provider of tax-compliance services. He writes about a variety of topics for Acronis, including cybersecurity trends, MSP management, emerging technologies and product updates. [Previous post](https://www.acronis.com/en/blog/posts/5th-annual-acronis-ot-virtual-conference-practical-insights-for-manufacturing-leaders/) [5th annual Acronis OT virtual conference: Practical insights for manufacturing leaders](https://www.acronis.com/en/blog/posts/5th-annual-acronis-ot-virtual-conference-practical-insights-for-manufacturing-leaders/) [Next post](https://www.acronis.com/en/blog/posts/top-five-best-cloud-security-solutions-in-2025/) [Top five best cloud security solutions in 2025](https://www.acronis.com/en/blog/posts/top-five-best-cloud-security-solutions-in-2025/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 5: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 6: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 7: Acronis Cloud Storage adds a recovery warranty](https://staticfiles.acronis.com/images/blog-card/6a693ef2012c6324f65b0b452c11b3d6.png) [Acronis Cloud Storage adds a recovery warranty](https://www.acronis.com/en/blog/posts/acronis-cloud-storage-adds-a-recovery-warranty/) Secure, scalable cloud storage with a recovery commitment backed by Acronis. The Anti-Ransomware Recovery Warranty that helps MSPs make recovery a visible part of the service they deliver. **October 12, 2026**4 min read