Make every remote connection explain itself.

Map the whole route

List supplier, employee and emergency access separately. Trace the route from the external user to the target system, including access gateways, intermediate hosts, identity services and the systems that record activity. An encrypted tunnel is one component of that route; it does not establish that the destination and permissions are appropriate.

Review the business need with operations. Some connections support time-sensitive maintenance; others remain enabled after the original task has ended. Record who owns the access and who can revoke it. Do not disconnect an operationally important link without an approved change and a safe recovery plan.

Questions for an access review

1. Is each user individually identified, with permissions limited to the approved task?
2. Is strong authentication available and appropriate for the access path?
3. Does access pass through a controlled boundary instead of exposing the control device directly?
4. Can operations approve, observe and terminate a maintenance session?
5. Are session records protected and available to the people investigating an event?
6. Does access expire or receive a documented periodic review?

Design for failure as well as success

Check what happens when an identity service, gateway, wide-area connection or logging system is unavailable. Emergency arrangements need an owner, restrictions and a record of their use. Review how local operators retain control. A security change that unexpectedly prevents safe operation has not met its purpose.

Agree evidence with the supplier

Ask for an access diagram, a description of account management, the approved support workflow and an explanation of how maintenance sessions are recorded. Avoid requesting passwords, private keys or sensitive production configurations by ordinary email. Review procurement and support requirements with the people responsible for the contract.

Use current guidance carefully

The joint 2026 secure-connectivity principles describe desired outcomes for OT connectivity. They are not a universal minimum requirement or a product certificate. Apply them to the consequences, constraints and dependencies of the particular operation. The 2025 joint remote-access advisory also addresses the exposure of OT systems to the public internet.

Document the review in the workbook. Use the OTCSA Zero Trust paper for the earlier architectural discussion and incident readiness for escalation planning.

A historical panel discussion

The June 2020 OTCSA webinar programme shows how remote diagnostics and collaboration became part of the alliance’s discussion during workplace disruption. Read it alongside the current guidance above.