FDA OT Security White Paper: Lessons for Pharmaceutical Manufacturing

FDA’s June 2025 white paper, Securing Technology and Equipment (Operational Technology) Used for Medical Product Manufacturing, shares lessons from securing an FDA research manufacturing environment. Pharmaceutical and biotechnology teams can use it to inform their own OT security work. The white paper is not a new blanket cybersecurity regulation for manufacturers.

Understand the scope of the white paper

The paper describes a continuous manufacturing demonstration environment and the work needed to connect and secure its equipment. It discusses technical information exchange, security standards and security by design. Its discussion of federal security requirements applies to the FDA environment described; it should not be presented as a universal FIPS certification mandate for every pharmaceutical manufacturer.

Use the paper as a technical reference alongside the requirements that actually apply to your facilities, products and quality systems. Confirm those obligations with the responsible quality, regulatory and security teams.

Start with equipment and communication visibility

Build an inventory of connected manufacturing equipment and the systems that support it. Record device ownership, function, support status, software dependencies and required communication. Include equipment embedded within larger systems and the remote access paths used by maintenance providers.

Coordinate discovery and testing with operations. Production equipment may have constraints that make an endpoint agent, an active scan or an unplanned configuration change unsuitable.

Use zones and conduits to review access

Group assets with shared security needs and define the communication required between those groups. Review paths between production lines, engineering workstations, laboratory systems and shared services. The paper’s discussion of zones and conduits offers a useful way to examine these relationships.

Segmentation should preserve required processes while restricting unnecessary access. Validate the design against actual dependencies and operational cycles before enforcement. A diagram or product purchase alone does not demonstrate conformance with IEC 62443 or another standard.

Where identity-based microsegmentation fits

Elisity IdentityGraph correlates network observations with identity, endpoint, CMDB, IoT and cloud context to build one record per asset. Teams use that context to define Policy Groups and review network access for users, devices and workloads.

Elisity simulates proposed policies against observed traffic and enforces approved access restrictions through supported network infrastructure. It does not install an Elisity software agent on protected assets. IdentityGraph provides correlated asset context; it does not authenticate every software process, replace MFA, or inspect TLS versions, ciphers and certificates.

Elisity Intelligence can propose classifications, Policy Groups and policies for administrator review. Suggested policies start in simulation. Administrators decide what moves to enforcement.

Learn from customer experience

Andelyn Biosciences and GSK describe why visibility, practical policy management and rollout planning matter in pharmaceutical environments. Use their published case studies to understand the operational approach; do not treat a customer story as a guaranteed cost reduction or deployment timeline for another organization.

Watch the GSK customer case study.

Keep the business case and compliance evidence specific

Measure the assets and access paths in scope, the work needed to deploy policies, and the time required to maintain them. Retain evidence of simulation, policy review, approvals and exceptions. Combine network policy evidence with the other controls and records your quality and security program requires.

Use your own licensing, staffing and implementation estimates to compare options. Do not assume a fixed TCO reduction, insurance discount or regulatory outcome from segmentation. Continue vulnerability management, authentication, monitoring, backup and recovery alongside access policy.

See how the Elisity platform works.

Frequently asked questions

Does the FDA white paper create a new cybersecurity mandate?

The June 2025 white paper describes technical work and lessons from an FDA research manufacturing environment. It is not a new blanket cybersecurity regulation for all pharmaceutical and biotechnology manufacturers.

Does it require every manufacturer to use FIPS-validated products?

Its discussion of federal security standards concerns the FDA environment described. Manufacturers should identify the requirements that apply to their own operations rather than treating that discussion as a universal mandate.

How can microsegmentation support manufacturing security?

It can restrict unnecessary network communication between assets and groups while preserving reviewed operational dependencies. Visibility, simulation, administrator approval and phased enforcement support a controlled rollout.

Does Elisity establish FDA or IEC 62443 compliance?

No product alone establishes compliance. Elisity can support asset context and network access policy evidence; organizations must assess their applicable obligations and maintain the other required controls, processes and documentation.

Sources

• FDA white paper, June 2025
• FDA innovative technologies research