MANUFACTURING / MANAGING DIRECTORS
When a cyber incident reaches your customers, what do you say?
A systems issue becomes a business issue when an order is delayed, a promise changes or a customer asks what is under control. This briefing shows three decisions leaders can make before they're under pressure.
Three decisions that protect customer confidence
1. Name the commitment that matters. Not every system needs the same priority. Start with the delivery, service or customer requirement that would create the greatest commercial difficulty if it slipped.
2. Separate what you know from what you're assuming. Identify the business impact confirmed so far, the alternatives available, and the information still being established. This prevents promising a date the team cannot support.
3. Give ownership to both the response and the message. One person coordinates the technical recovery. Another has authority to agree the customer-facing commitment and next update. They need to be talking to one another.
Completed leadership card: A major customer order has a Friday delivery date. An external system used for release is unavailable on Wednesday morning. The team confirms 70% of the order is unaffected; the remainder needs another decision. The MD authorises the account lead to explain the confirmed position, gives the customer a 2pm Thursday update time and avoids promising complete Friday delivery before Operations agrees it. The result is a clear, credible commitment, not a guarantee that nothing will go wrong.
For your next recovery test One priority customer commitment, one owner for the operational answer, one named person responsible for telling the customer.
What JLR's cyber incident says about business continuity
JLR's September 2025 cyber incident led to a production pause. In its November 2025 quarterly results, JLR reported £196 million in cyber-related exceptional costs for that quarter, and described supplier-financing measures during its recovery.
JLR is a much larger business than most manufacturers reading this page. These figures are not an estimate of what a smaller factory would lose. The useful lesson is how a technology incident can reach production, suppliers, cash flow and customers at the same time.
Three leadership lessons: Agree what work is most important; give customers realistic information; know who can make a commercial decision while the technical picture is changing.
When a customer asks for proof of cyber security
A security question in a tender or customer review doesn't always justify buying another product. Start by sorting the answer into three groups.
Completed example, clearly illustrative:
| What the customer asks | What your business can say today | What follows |
|---|---|---|
| How is staff access protected? | MFA is in place for the agreed accounts, with an IT-owned configuration record available. | Provide approved evidence rather than a new purchase request. |
| Can essential data be restored? | Backups run, but the business has not signed off an end-to-end recovery outcome. | Arrange a focused service recovery exercise with the current IT provider. |
| Who handles a security incident? | An escalation owner is named; customer-notification responsibilities are less clear. | Agree owners and a sensible communications process. |
Takeaway: Separate already evidenced, needs demonstrating and genuine improvement required. This can save time and prevent overpromising.
The first customer update is rarely about having all the answers
Illustrative message: “We're investigating an interruption affecting part of our order process. We're confirming whether your scheduled delivery will change, and we'll update you by 3pm today with the position we can verify.”
Why it works: It states the situation without speculation, avoids promising a delivery date too early, and commits to a time for the next update. Only send this after your team confirms that wording is true and appropriate.
HOW ASSURED DIGITAL CAN HELP
A focused improvement, not necessarily a major IT project
Assured Digital works with businesses on cyber security, Microsoft services and digital support. We can help identify where existing arrangements already support a customer requirement and where a focused improvement could make a difference, alongside your current provider if appropriate.