[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract

MANUFACTURING & INDUSTRIAL

Production lines run on vendor software. Prove they can recover

Manufacturers depend on third-party ERP, MES, quality-management and IIoT platforms. Castler independently rebuilds critical vendor applications and produces signed Proof of Recovery so operational resilience is supported by tested evidence—not an unverified deposit.

ISO 27001SOC 2 Type IICERT-InPCI DSS

PRODUCTION SOFTWARE ESTATE

Recovery evidence across plant and enterprise systems

01ERP · planning
RECOVERY PATH
02MES · production
RECOVERY PATH
03IIoT · condition
RECOVERY PATH

SIGNED OUTPUT

Proof of Recovery · per system · per verified release

THE PROBLEM

Industry 4.0 made production dependent on software it did not build

Modern production planning, quality, asset performance and supply-chain operations rely on third-party platforms and specialist vendor knowledge. When one critical system fails, the effect moves rapidly from the application layer to the factory floor.

ERP vendor disruption

A manufacturing ERP supplier changes ownership or retires an India-specific release. Production planning, procurement and dispatch remain live, but the manufacturer lacks a tested independent recovery path.

MES faulty update

A manufacturing-execution update corrupts scheduling or work-in-progress data across multiple plants. Recovery depends on whether the previous release and deployment procedure are complete and reproducible.

IIoT vendor insolvency

A specialist predictive-maintenance platform enters insolvency. Condition monitoring and alerting degrade while plant teams attempt to reconstruct the operating environment and integrations.

DOCUMENTED INCIDENT · JLR 2025

The JLR incident is the benchmark every manufacturer now plans against

A cyber incident halted JLR production for five weeks and disrupted its supply chain. The Cyber Monitoring Centre estimated £1.9B in economic impact and more than 5,000 affected organisations. The documented lesson is the scale and propagation of software-dependent operational disruption.

Read the Cyber Monitoring Centre assessment

5 weeks

Production halted

5,000+

Organisations affected

£1.9B

Estimated economic impact

THE CONTINUITY STANDARD

Recoverability is becoming a procurement and governance requirement

ISO 22301 provides a management framework for business continuity. ISO/IEC 27001 addresses information-security risk, including supplier relationships. Regulated enterprise customers increasingly translate those expectations into contractual escrow, exit and recovery requirements for critical software vendors.

ISO 22301

Business-continuity management for disruption readiness and recovery

Proof of Recovery + Deployment Runbook

ISO/IEC 27001

Information-security management, including supplier and technology-risk controls

Custody record + SBOM + verification evidence

Enterprise contract obligations

Customer-defined escrow, exit and continuity requirements for critical software suppliers

Escrow agreement + signed evidence pack

THE SOLUTION

Signed recovery evidence for every critical production system

Castler's agentic verification engine rebuilds critical manufacturing software in a clean environment without depending on the vendor's operating team. A named Castler engineer reviews the evidence and signs the resulting recovery pack.

01

ERP and enterprise platforms

SAP, Oracle and homegrown ERP releases kept current in custody and verified against the declared production architecture.

02

Manufacturing execution systems

MES, quality-management, production-scheduling and OEE platforms independently rebuilt and backed by signed recovery evidence.

03

IIoT and predictive platforms

IIoT orchestration, predictive-maintenance and condition-monitoring systems covered under a release-specific Software Estate programme.

REPRESENTATIVE PROGRAMME

A practical path from plant-software dependency to signed recovery evidence

This is an illustrative manufacturing remediation model, not a claimed customer engagement. Scope and timelines depend on application complexity, plant constraints, deposit quality and vendor cooperation.

01

Prioritise production dependency

Map ERP, MES, quality, IIoT and supply-chain systems by plant impact, supplier concentration and recovery-time requirement.

02

Establish current custody

Bring source, configuration, infrastructure definitions and runbooks into controlled custody and identify undocumented dependencies.

03

Verify and sign

Rebuild each scoped release independently, test the recovery procedure and issue the signed Proof of Recovery pack.

OUTPUT PACKBuild ReportDeployment RunbookReplication ReportSBOMSigned Proof of Recovery

MANUFACTURING & INDUSTRIAL

Map the production Software Estate to the recovery evidence it needs

Bring your critical ERP, MES, quality and IIoT vendor estate. We will map custody, verification and signed evidence in a 15-minute briefing.

Book a 15-min briefing
ISO 27001SOC 2 Type IIPCI DSS

No spam · Reply within one business day