Cybersecurity requirements for small defence suppliers

A prime contractor has asked all its suppliers to meet stricter cybersecurity requirements, including access controls, encrypted storage of technical drawings and regular audits. We are a forty-person machining company with one IT person.

We have started with an inventory of systems, multi-factor authentication and separating production machines from the office network. The documentation burden worries us more than the technical changes. Suppliers who went through similar audits: which external support was worth paying for?