Remote Access, Vendors and the Supply Chain

Rules, standards and guidance described: NIST SP 800-82 Rev. 3 (September 2023; Draft Rev. 4 released Sept. 21, 2026, comments due Nov. 30, 2026); CISA, FBI, EPA and DOE "Primary Mitigations to Reduce Cyber Threats to Operational Technology" (May 6, 2025); "Secure connectivity principles for operational technology" (NCSC-UK with CISA, FBI and partners, January 2026); CISA and FBI "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators" (Sept. 23, 2026); "Secure by Demand" for OT buyers (Jan. 13, 2025); "2026 Minimum Elements for a Software Bill of Materials" (July 29, 2026); CISA advisory AA26-097A (April 7, 2026, updated July 22, 2026); NERC CIP-005-7, CIP-003-9 (effective April 1, 2026) and CIP-013-2; TSA Security Directive Pipeline-2021-02G (effective May 3, 2026 to May 2, 2027); ANSI/ISA-62443-2-4-2018 (described, not quoted). All checked Oct. 28, 2026. Rules and guidance change; check the current text before relying on any of it.

Why remote access is the front door

Operational technology (OT) is the hardware and software that runs physical equipment: the programmable logic controllers (PLCs) that open valves and run conveyors, the human-machine interfaces (HMIs) operators watch, the supervisory control and data acquisition (SCADA) systems that tie remote sites together, and the engineering workstations used to program them. Lesson 1 explains these terms and the Purdue model of plant network levels. This lesson is about the doors into that world from outside the plant.

"Remote access" here means any way a person or a computer outside the plant's own control network can see or change something inside it. That includes the vendor engineer in another state who logs in to tune a machine, the plant manager checking production from home, the integrator who installed a cellular modem in a pump station so he would not have to drive there, and the cloud service a new machine reports to every minute. Every one of these is useful. Every one is also a path an attacker can try.

Plants did not add remote access carelessly. They added it because skilled controls people are scarce, plants are often far from the vendor, and downtime is expensive. A machine builder in Germany or Ohio can diagnose a fault in minutes over a connection that would take two days and a plane ticket in person. NIST's OT guide says it plainly: there are "many reasons why an OT may need to be remotely accessed, including vendors and system integrators performing system maintenance functions or OT engineers accessing geographically remote system components."⁷ The goal of this lesson is not to remove that convenience. It is to make sure only the right people get in, only when they should, only to what they need, and that someone is watching.

What the incident record shows

Lesson 3 tells the full stories. Here is what each one teaches about remote access.

• Colonial Pipeline, May 2021. Chief executive Joseph Blount told a Senate committee on June 8, 2021, "we believe the attacker exploited the legacy VPN profile that was not intended to be in use," and that the account "did only have single-factor authentication." The ransomware encrypted IT systems, not the pipeline controls, but the company shut down the pipeline because, as Blount put it, "if there was one percent chance that that OT system was compromised, it was worth shutting the pipeline system down."⁸ The lessons: a forgotten remote account is as dangerous as a live one, a password alone is not enough, and a remote access problem on the business side can still stop operations.
• Ukraine's power distribution companies, December 2015. Attackers opened breakers at three regional companies, cutting power to about 225,000 customers. CISA's alert says they operated the breakers "using either existing remote administration tools at the operating system level or remote industrial control system (ICS) client software via virtual private network (VPN) connections," with credentials probably stolen beforehand.⁹ This is the clearest public case of an attacker using the plant's own legitimate remote access to operate equipment.
• Unitronics PLCs, November 2023. Iran-linked actors calling themselves CyberAv3ngers defaced Israeli-made PLCs used in water systems and other industries in several U.S. states. The joint advisory says they got in by compromising default credentials on devices reachable from the internet, and it told owners to "Check PLCs for default passwords."¹⁰
• Internet-exposed PLCs, 2026. CISA advisory AA26-097A (April 7, 2026, updated July 22, 2026) says Iranian-affiliated actors "disrupted PLCs across several U.S. critical infrastructure sectors," and widened its warning from one brand to "potentially all internet exposed PLCs." Among its key actions: "Remove PLCs from direct internet exposure via secure gateway and firewall."¹¹ CISA later said it saw attacks on more than 100 internet-exposed U.S. water and wastewater systems in July 2026.¹² In Minnesota, the city of Plymouth disconnected cellular-connected equipment at water towers and lift stations and ran them by hand.¹³
• A U.S. automation integrator, March to April 2025. According to FBI analysis cited in the September 2026 CISA and FBI fact sheet, foreign actors got into the network of a U.S. company that did system integration and SCADA programming for power and transportation customers. They searched for "customers" and "SCADA" and packed about 800 files, including customer SCADA information and device details, into nine archives for presumed theft.⁵ The plants themselves were not touched in that report. Their blueprints were.

Look at what is missing from that list: exotic zero-day exploits against PLC firmware. The common pattern is ordinary access that was left open, protected by a password alone, or never known to exist.

What the numbers say

Industry reports measure different things in different ways, so treat each number as that publisher's finding, not a census.

• Dragos, an OT security company, wrote in its 2026 Year in Review (Feb. 17, 2026) that "73 percent of all-time IR cases involved compromised VPN or jumphost credentials." The same review found poor IT and OT segmentation in 81 percent of its assessments and adequate OT network monitoring in only 46 percent.¹
• IBM X-Force named manufacturing the most-attacked industry for the fifth straight year in its 2026 index, with 27.7 percent of incidents in 2025. The top ways in were public-facing applications (32 percent), valid accounts (16 percent) and external remote services (11 percent).¹⁴ Two of those three are about remote access and stolen logins.
• Verizon's 2025 Data Breach Investigations Report found stolen credentials in 34 percent of manufacturing breaches, exploited vulnerabilities in 23 percent and phishing in 19 percent, and that "more than 90% of breached organizations were SMBs with fewer than 1,000 employees."¹⁵
• CISA's Known Exploited Vulnerabilities catalog listed 1,760 entries on Oct. 27, 2026, but only a handful are for OT vendor products. Most are for IT software and edge devices such as VPN appliances and firewalls, which is how attackers usually get to OT.¹⁶

Why OT makes remote access riskier than in an office

Office IT has spent twenty years hardening remote access. OT is catching up, for reasons that are not anyone's fault.

• Old equipment cannot do modern sign-in. Many PLCs and HMIs support a single shared password or none at all. NIST notes that "some OT components support only a single factor or no authentication."¹⁷ That is why the security has to live in front of the device, in a gateway or jump host, rather than on it. CISA's 2026 advisory says the same thing: "A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA."¹¹
• Equipment lives for decades. A remote connection set up during commissioning in 2008 may still be there, still using the same account, long after the person who set it up has left. Colonial's "legacy VPN profile" is the textbook case.⁸
• Shared accounts are normal. Secure by Demand notes that "A singular admin account is not uncommon in OT devices," which encourages sharing and makes it "difficult to identify who made any given change."¹⁸
• Vendors are everywhere. A mid-size plant may have a dozen machine builders, each with its own preferred remote tool. Each one is a separate door with its own keys.
• The consequences are physical. A stolen office login can leak files. A stolen login to an engineering workstation can change how a machine moves or what a safety alarm does. AA26-097A describes changes that "disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators."¹¹ Lesson 5 covers safety systems in detail.

NIST sums up the weakness in its list of common OT vulnerabilities as "Poor remote access controls," and says "The concept of least privilege should be applied to remote access controls."⁷ Least privilege means each person or system gets only the access needed for the job at hand, and no more.

The kinds of remote access you will find in a plant

Most plants have more ways in than anyone thinks. Below are the common types, described so you can recognize them and ask about them. None of this is a how-to for getting in; it is a list of what to look for and protect.

Vendor support connections

The classic arrangement: the equipment vendor or system integrator has a standing VPN account, a site-to-site VPN tunnel from its office, or a vendor-supplied remote access appliance in the plant. These are often written into the support contract. NIST notes that modem and remote connections are sometimes part of the vendor service agreement (its example is "24/7 support with 15-minute response time"), and warns that "disconnecting or removing the modems may require contracts to be renegotiated."² Questions to ask: Who at the vendor has the credentials? Are they shared among the vendor's technicians? Is the connection always on? Does it reach one machine or the whole control network? Does the plant know when it is in use?

Remote desktop and remote monitoring tools installed by staff

Commercial remote desktop and remote monitoring and management (RMM) tools let someone see and control a computer's screen from anywhere. Staff and vendors sometimes install them on an HMI or engineering workstation to save a trip, without telling IT. CISA, the NSA, the FBI and partners warned in their June 6, 2023 "Guide to Securing Remote Access Software" that these tools help "IT, OT, and ICS professionals" troubleshoot, but their features also make them attractive to attackers. The guide says such software often "does not always trigger security tools," because it is legitimate and signed, and that it can be run as a portable program that skips normal installation controls.¹⁹ The guide's advice: audit which remote access tools are on your devices, allow only the approved ones, and require that approved tools "only be used from within your network over approved remote access solutions, such as VPNs or virtual desktop interfaces."¹⁹ The office-side basics of remote work are in Network, Wi-Fi and Remote Work (Module 72); this lesson focuses on what is different on the plant floor.

Cellular modems and gateways on equipment

A small cellular router inside a control panel, a pump station or a water tower gives a vendor or operator a connection that never touches the plant network at all. That is why these devices are so often missed: the firewall team never sees them. They are common at remote sites such as wells, lift stations, tanks and pipelines, and increasingly on new machines that ship with a modem for vendor support. The July 2026 update to AA26-097A added specific advice: "Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated," log and review modem activity, and consider isolated cellular designs such as a private cellular network name or a site-to-site VPN.¹¹ Plymouth, Minnesota's decision to disconnect its cellular-connected equipment during the July 2026 attacks shows why it helps to know in advance where every such modem is and how to turn it off.¹³

Cloud-connected machines and vendor portals

Newer equipment, from compressors and chillers to CNC machines and packaging lines, may report to the manufacturer's cloud service for monitoring, predictive maintenance or billing by usage. Some of these connections are one-way (data out only). Others let the vendor push settings or software back down. The difference matters a great deal, and buyers should ask. The 2026 integrator fact sheet tells owners to ask "What organizational data does the integrator store or have access to?" and "Where is the data stored?", noting that data stored abroad may fall under another country's laws.⁵ Secure by Demand's "Ownership" element asks whether the product lets operators "do what is needed without an onward dependency on the vendor."¹⁸

Dial-up modems and other old paths

Some plants still have analog modems connected to phone lines for vendor support of older equipment. They are easy to forget because nobody has used them in years. NIST's guidance for any modem that must stay: use callback (the modem hangs up and calls back a number on an approved list), and "If feasible, disconnect modems when not in use."² Other old paths include wireless bridges set up for a temporary project and never removed, and firewall rules opened "temporarily" for a commissioning job years ago.

Engineers and managers working from home

Plant staff on call at night may connect from home to look at alarms or adjust a setting. This is often the most defensible kind of remote access, because the users are employees the plant can train and manage, but it still needs the same controls: company-managed devices, multifactor sign-in, and a path through the DMZ rather than straight into the control network. A view-only connection (see alarms and trends, change nothing) covers most night calls and carries far less risk than full control.

Integrator laptops and portable media

Not all third-party access is remote. An integrator who plugs a laptop into the control network, or hands over a USB drive with a new program, brings whatever is on that laptop or drive into the plant. The same rules apply: know who is connecting, with what, to what, and why. Many plants keep a scanned, plant-owned laptop or a kiosk for checking media so outside laptops never touch the control network.

Find every path: the remote access inventory

Every serious guide starts here. CISA's 2025 OT fact sheet lists "Remove OT connections to the public internet" as mitigation number one, and you cannot remove what you have not found.³ The September 2026 integrator fact sheet tells owners to "Request an inventory of all software and hardware supplied by the integrator, as well as documentation for how it connects to your infrastructure and how it will be updated."⁵ The 2026 connectivity principles say all OT connections should be centralized and standardized, which starts with knowing what they are.⁴

CISA and its partners published "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators" on Aug. 13, 2025. It defines an asset inventory as "an organized, regularly updated list of an organization's systems, hardware, and software," and says finding assets takes both "a physical inspection and logical survey."²⁰ For remote access, that pairing matters. Network tools will not see a cellular modem that never touches the plant network, and a walk through the panels will not show a remote desktop tool hidden on an HMI. You need both.

How to build the inventory

1. Ask people. Sit down with maintenance, controls engineering, IT, purchasing and the plant manager. Ask each: "Who outside this building can connect to anything on the plant floor, and how?" Then ask the same question of each major equipment vendor and integrator, in writing.
2. Read the contracts. Service and warranty agreements often promise remote support, which means a remote path exists somewhere. Note the response times promised; NIST warns that removing a path may mean renegotiating them.²
3. Walk the floor and the field. Open control panels (with the safety lead's permission and following lockout rules), and look for cellular routers, antennas, phone lines into modems, wireless bridges and unlabeled network gear. Check remote sites too.
4. Check the computers. List the software on every HMI, engineering workstation and OT server, looking for remote desktop and remote monitoring tools. The 2023 remote access software guide recommends auditing remote access software "to identify currently used and/or authorized" tools.¹⁹
5. Check the firewalls and the internet view. Have IT list every rule that lets traffic from outside reach the OT network or the DMZ. CISA's free vulnerability scanning service "Identifies externally-accessible assets and services that are vulnerable to common attacks," which helps confirm nothing in the plant answers from the internet.²¹
6. Check the accounts. List every account that can log in remotely, who owns it, and when it was last used. Disable accounts nobody can explain. CISA's 2025 fact sheet says to "disable dormant accounts."³
7. Write it down in one place and set a date to review it, at least yearly and after every new machine, vendor or project.

Any change to a firewall, a modem or a remote tool on a running plant should be planned with the equipment vendor, the safety lead and qualified controls engineers, and tested first. Turning off a path the plant quietly depends on (for example, a vendor's automatic data upload that a machine's warranty requires) can cause its own outage.

What to record for each path

For each path, the inventory should answer: where it physically and logically sits; which vendor or person uses it and under which account; how users sign in (password only, MFA, certificate); whether it is always on or enabled only on request; which zones and devices it can reach; whether anyone monitors or records sessions; and exactly how to cut it off in a hurry. NIST's list includes "Labeling remote connection devices so that operations may disconnect quickly in the case of unauthorized use."² CISA's asset inventory guide lists "user accounts," "ports/services," "logging" and "physical location" among the 14 high-priority attributes to collect for each asset, and those same fields describe a remote path well.²⁰

The inventory is also how you find duplication. Many plants discover three or four separate vendor tools doing the same job. The 2026 connectivity principles recommend centralizing: "centralise remote access through a secure solution hosted in the DMZ."⁴ Fewer doors are easier to watch.

Secure remote access: the principles the guidance agrees on

Government and standards bodies use different words, but they converge on a short list. This section goes through each source, then each principle.

What NIST SP 800-82 says

NIST Special Publication 800-82 Revision 3, "Guide to Operational Technology (OT) Security" (September 2023), is the main U.S. government guide for OT. It is free. (NIST released a draft Revision 4 on Sept. 21, 2026, open for comment until Nov. 30, 2026; Rev. 3 remains the final version.)²² Lesson 2 explains the whole document. Its remote access section, 6.2.10, says:

"Remote access should be provided only if justified and limited to what is required for the business need. Remote access should not circumvent or negate safety or security controls. Multi-factor authentication should be considered for remote access to the OT system."²

For temporary vendor access, whatever the technology, NIST tells organizations to consider unique usernames and complex passwords; removing default credentials; keeping software and firmware current; "Removing access when no longer required," including "automatic timers"; "Monitoring remote activities"; "Ensuring that operations personnel are aware of planned remote activity in the OT environment"; "Initiating the connection from the OT environment"; and labeling remote connection devices so they can be disconnected quickly.² It adds that only TLS 1.2 or above should be considered for encrypted connections.²

Elsewhere NIST says maintenance tools for remote work should support "authentication of maintenance personnel, connection establishment at the beginning of maintenance activities, and immediate teardown once the maintenance activities are performed," and should "log the remote maintenance activities that are performed."²³ In its OT overlay of federal security controls, NIST added the control for disconnecting or disabling remote access to every baseline, low, moderate and high, explaining that "the capability to disconnect or disable remote access is critical to managing risk," and that "OT personnel should be trained on how to use the remote access disconnect."²⁴

What CISA and its partners say

The May 6, 2025 fact sheet from CISA, the FBI, the EPA and the Department of Energy, "Primary Mitigations to Reduce Cyber Threats to Operational Technology," lists five steps. Three are about remote access: "Remove OT connections to the public internet"; "Change default passwords immediately and use strong, unique passwords"; and "Secure remote access to OT networks," which means, where remote access is essential, a private connection and a VPN "with a strong password and phishing-resistant multifactor authentication (MFA)," least privilege, and disabling dormant accounts. It warns that attackers find exposed devices "by searching for open ports on public IP ranges with search engine tools," using "simple, repeatable, and scalable toolsets available to anyone with an internet browser."³ It also urges regular contact with service providers, integrators and manufacturers, because a misconfiguration can come from any of them.³

The 2026 PLC advisory, AA26-097A, is more specific. Owners should "remove inbound port exposure," so that the OT system "is never directly exposed to the internet or external networks," and "ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection."¹¹ It also says to require MFA for access to the OT network from outside, to put a gateway, firewall or VPN in front of PLCs, to keep tested offline backups of PLC logic, and to secure cellular modems.¹¹

The 2026 "Secure connectivity principles for OT"

In January 2026 the UK's National Cyber Security Centre led a joint publication with CISA, the FBI and agencies from Australia, Canada, Germany, the Netherlands and New Zealand, "Secure connectivity principles for operational technology (OT)."²⁵ It sets out eight principles, framed as goals rather than minimum requirements: balance the risks and opportunities; limit the exposure of your connectivity; centralise and standardise network connections; use standardised and secure protocols; harden your OT boundary; limit the impact of compromise; ensure all connectivity is logged and monitored; and establish an isolation plan.⁴ Several passages speak directly to vendors and remote access:

• "All connections with the OT environment should be initiated as outbound connections from within the OT environment," which "helps avoid exposing inbound ports on the OT network perimeter."
• Use "brokered connections through a secure gateway located in a separate, security-controlled segment," and "a hardened jump host to facilitate vendor support, ensuring access is controlled and monitored."
• "Where possible, use just-in-time access, enabling connectivity only when required and disabling it otherwise."
• "Where third parties require access through remote connectivity, flexibility should be embedded within contractual agreements."
• Break-glass accounts "should not be used as a standard remote access method," and any attempt to use one should trigger "the highest criticality alarm."
• "Monitoring is your last line of defence when designing secure connectivity."⁴

What ISA/IEC 62443 adds

The ISA/IEC 62443 series is the international standard family for industrial automation and control system security. It is sold, not free, so this lesson describes it rather than quoting it; Lesson 2 explains the series.²⁶ Three ideas from it shape remote access design:

• Zones and conduits. A zone is a group of assets with similar security needs; a conduit is the set of communication channels connecting zones. A remote access path is a conduit, and the standard asks you to define and protect it like one, with its own requirements, rather than treating it as a hole in a wall.²⁷
• Foundational requirements. Among the seven, Identification and Authentication Control (FR 1), Use Control (FR 2), Restricted Data Flow (FR 5) and Timely Response to Events (FR 6) map almost directly onto MFA, least privilege, brokered and limited paths, and logging.²⁷
• Roles. The series separates the asset owner, the product supplier, the integration service provider and the maintenance service provider. Part 2-4 sets security program requirements for the service providers, the integrators and maintenance firms who most often hold remote access. More on that below.²⁷

Principle 1: nothing in OT answers from the internet

No PLC, HMI, engineering workstation or OT server should accept a connection that starts on the public internet. This is the one control every 2025 and 2026 government document puts first, because the attacks it stops are the cheapest ones to run. The CyberAv3ngers defacements of 2023 and the 2026 PLC disruptions both relied on devices that could be reached directly.¹⁰¹¹ Removing exposure usually means putting the device behind a firewall with no inbound rules from outside, moving any remote need onto the brokered path described below, and confirming the result with an outside scan. Plan the change with the vendor and integrator who set the device up, since they may be the ones relying on the open path, and with the safety lead, and test it before cutting over.

Principle 2: phishing-resistant multifactor sign-in at the front door

Multifactor authentication (MFA) means proving who you are with two or more different kinds of evidence, such as a password plus a physical security key. NIST calls MFA "an accepted best practice for remote access to OT applications."¹⁷ Not all MFA is equal. Codes sent by text message and push prompts that a tired user can approve by mistake can be defeated by phishing and by "MFA fatigue" attacks. CISA "strongly urges all organizations to implement phishing-resistant MFA," and recommends number matching as an interim step for push-based systems that cannot yet move.²⁸ Phishing-resistant methods include FIDO security keys and passkeys and smart-card (certificate) sign-in, which cannot be replayed on a fake website.²⁹ The basics of passkeys and security keys are covered in Passwords, Two-Step and Passkeys (Module 71), and the business view, including the MFA strength ladder, is in Identity, Access and Device Control (Module 73).

The OT twist is where the MFA goes. Since many controllers cannot do MFA at all, put it at the remote access gateway and the jump host. As AA26-097A puts it, "A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA."¹¹ Secure by Demand makes the same point: "Jump hosts are a way to add MFA restrictions to OT networks."¹⁸ NIST notes that some plants use MFA for remote access while relying on physical access controls for people already standing in the control room.¹⁷

Every vendor technician should have a named account, not a shared "vendor" login. Named accounts are how you know who did what, and how you cut off one person who leaves the vendor without cutting off everyone. NERC's supply chain standard requires utilities to have processes for "Notification by vendors when remote or onsite access should no longer be granted to vendor representatives," a good clause for any contract.³⁰

Principle 3: a jump host in the DMZ, not a tunnel into the plant

A DMZ (demilitarized zone) in plant networking is a separate buffer network between the business (IT) network and the control (OT) network. NIST's executive summary recommends "Employing a DMZ network architecture (e.g., prevent direct traffic between the corporate and OT networks)."³¹ A jump host (also called a jump server, bastion host or broker) is a hardened computer in that DMZ that remote users log in to first. From there, and only from there, they reach the specific OT systems they are allowed to touch. NIST's remote access section does not use the term "jump host," but its advice to initiate connections from the OT side, monitor sessions and label disconnect points describes the same pattern, and CISA's 2026 advisory and the 2026 connectivity principles name it outright.¹¹⁴

Why a jump host instead of simply giving the vendor a VPN account into the control network? A VPN tunnel puts the vendor's laptop, with whatever is on it, directly onto your plant network. A jump host gives the vendor a screen on a computer you own, set up the way you want, with only the tools you approved, and with recording on. The vendor's laptop never touches your control network. Lesson 7, A Plant-Floor Segmentation Plan, shows where the DMZ and jump host sit in a full design.

A good jump host setup has these features:

• It sits in the DMZ, reachable from outside only through the MFA gateway, and it can reach only the specific OT systems each user needs.
• It is hardened: patched, with unneeded software removed, no web browsing or email, and its own monitoring.
• Each vendor or user has a role that limits which targets they can reach and what tools they can use.
• It records sessions and logs every connection and file transfer.
• File transfers into OT go through a checked process, not drag and drop.
• It can be shut off as a single point, which turns off all remote access at once in an emergency.

That last feature is also the main criticism of jump hosts: they concentrate risk. Dragos's figure of 73 percent of its incident cases involving "compromised VPN or jumphost credentials" is a reminder that a jump host protected by a password alone is just a nicer-looking front door.¹ The jump host only helps if it has strong sign-in, tight roles and someone watching it.

Principle 4: vendor access is off until someone turns it on

Standing access, always on and waiting, is the pattern behind most of the cases above. The fix is on-demand or "just-in-time" access: the vendor's account or connection is disabled by default and enabled only for an approved job and a set time window, then disabled again automatically. NIST suggests "automatic timers for removing access."² The 2026 integrator fact sheet says to "Use on-demand remote access if possible, so operators have to proactively allow remote access."⁵ The connectivity principles say to enable connectivity "only when required and disabling it otherwise."⁴

Supervision means someone in the plant knows the session is happening and can watch it. NIST lists "Ensuring that operations personnel are aware of planned remote activity in the OT environment."² In practice the operator on shift is told when the vendor will connect and what they will change, the vendor works where the operator can see the screen (shared session view or a recorded and live-viewable jump host session), and the operator can end the session if something unexpected happens. Supervision does not need a security expert. It needs someone who knows what the process should be doing.

Principle 5: record sessions and keep the logs

If something goes wrong after a vendor session, the first question is "what did they change?" Without a log, nobody can answer. NIST says remote maintenance tools should "log the remote maintenance activities that are performed."²³ The integrator fact sheet's heading is "Monitor and log remote access," and it adds: "Ensure integrators access equipment using routes you are able to monitor."⁵ The 2023 remote access software guide recommends reviewing logs for remote tool use and keeping direct access to log servers, and the ability to delete or alter logs, out of reach of remote management tools, so an intruder using the same tool cannot erase the trail.¹⁹

What to keep: who connected, from where, when, for how long, to which systems, what files moved, and (where the jump host supports it) a video-style recording of the screen. Keep logs somewhere the vendor account cannot reach. Decide how long to keep them; regulated sectors set their own retention rules, and a plant that is not regulated should keep them at least long enough to cover the time it usually takes to notice a problem. Secure by Demand asks buyers to choose products that log "authentication events, both successful and unsuccessful," changes to engineering logic and firmware, and deletion or modification of logs, by default and at no extra charge.¹⁸

Principle 6: outbound-only and one-way options

Two designs reduce risk further where they fit.

• Outbound-only connections. Instead of letting anyone connect in, a component inside the plant reaches out to a broker when the plant approves a session. Nothing in the plant listens for incoming connections, which removes the open door that scanners look for. NIST lists "Initiating the connection from the OT environment" as a consideration, and the 2026 connectivity principles say "All connections with the OT environment should be initiated as outbound connections from within the OT environment."²⁴
• One-way (unidirectional) gateways. When the vendor or the business office only needs to see data, such as production counts, alarms or machine health, a one-way gateway (often called a data diode) can send data out while making it physically impossible for anything to come back in. NIST describes unidirectional gateways as devices that "cannot be programmed to allow data to flow in both directions because the hardware is incapable."³² Remote monitoring through a one-way link is often enough for vendors who support equipment by watching its performance.

Neither design fits every need: a vendor who must change a program still needs a two-way path, and one-way gateways cost more than a firewall. Many plants combine them: one-way for routine monitoring, an on-demand brokered session for the rare job that requires changes.

Principle 7: plan the emergency, so the emergency does not plan you

At 2 a.m. with a line down, the pressure to "just open it up" is enormous, and that is when temporary exceptions become permanent holes. Write down an emergency (break-glass) procedure in advance: a sealed or vaulted credential, who may approve its use, how the use is announced, and a review the next business day. The 2026 connectivity principles say break-glass accounts "should not be used as a standard remote access method" and that any attempt to use one should trigger the highest-level alarm.⁴ NIST notes that temporary remote access in critical situations is legitimate, but "procedures should still be followed to ensure that secure connections are being utilized."²

Principle 8: a labeled off switch, and the ability to run without it

Every remote path should be something operations can cut quickly and confidently: a labeled disconnect on the modem, a single control that disables the remote access gateway, a documented step in the incident plan. NIST: "Labeling remote connection devices so that operations may disconnect quickly in the case of unauthorized use."² The off switch is only useful if the plant can keep running when remote help is gone. CISA's fifth primary mitigation is to "Practice and maintain the ability to operate OT systems manually," and the integrator fact sheet asks, "Can the organization operate independently if the integrator is compromised?", urging offline backups of "all software required to operate equipment."³⁵ Aliquippa, Pennsylvania in 2023 and Plymouth, Minnesota in 2026 both switched to manual operation after attacks on remote-reachable controllers.¹⁰¹³

Two 2026 joint publications build on this. "Adapting Zero Trust Principles to Operational Technology" (April 29, 2026), from CISA with the Department of War, DOE, the FBI and the State Department, focuses on zones and conduits, supply chain risk, identity and access management, legacy systems and safety.³³ "CI Fortify: Advice for isolating vital systems" (July 28, 2026) tells operators to map dependencies, build separation points in advance and test a graduated isolation plan; CISA's announcement of it says "physical isolation remains the most risk-effective solution."³⁴ Cutting vendor and remote access is usually the first, easiest step of any such plan, which is one more reason to know where every path is. Whatever isolation design you choose, plan and test it with the vendor, the safety lead and qualified controls and process safety engineers before you rely on it.

What regulated sectors already require

Most manufacturers are not under a federal cybersecurity rule for their plant floor. Some neighbors are, and their rules are a useful yardstick: they show that these controls can be required, audited and lived with. Lesson 6 covers each rule in full; this section pulls out only the remote access and vendor parts.

NERC CIP and the power grid

The North American Electric Reliability Corporation's Critical Infrastructure Protection (CIP) standards are mandatory for registered owners and operators of the bulk power system, approved by the Federal Energy Regulatory Commission. FERC's October 2026 notice counts about 1,706 U.S. entities subject to them.³⁵ A typical factory is not covered just because it buys electricity.

• CIP-005 (Electronic Security Perimeters). Under CIP-005-7, Interactive Remote Access to the higher-impact systems must go through an "Intermediate System" (the standard's term for a jump host), with encryption that ends at the Intermediate System and multifactor authentication for all Interactive Remote Access sessions (Requirement R2, Parts 2.1 to 2.3).³⁶ Utilities must also "Have one or more methods for determining active vendor remote access sessions" and "Have one or more method(s) to disable active vendor remote access." A newer part extends vendor controls to the access control and monitoring systems themselves: entities must be able to "determine authenticated vendor-initiated remote connections" and terminate them.³⁷ FERC Order No. 919 (March 2026) approved a new version, CIP-005-8, as part of a package for virtualized systems, expected to take effect July 1, 2028.³⁸
• CIP-003-9 (low impact systems). Since April 1, 2026, even low impact sites must have a vendor electronic remote access program covering three things: identifying when vendor connections are active, disabling that access when needed, and detecting known or suspected inbound and outbound malicious communications for that access (Attachment 1, Section 6).³⁹
• CIP-013 (supply chain). CIP-013-2's procurement processes must address vendor incident notification, "Notification by vendors when remote or onsite access should no longer be granted to vendor representatives," "Disclosure by vendors of known vulnerabilities," "Verification of software integrity and authenticity of all software and patches provided by the vendor," and "Coordination of controls for vendor-initiated remote access."³⁰ In FERC Order No. 912 (September 2025) the commission directed NERC to tighten the supply chain standards, including periodic reassessment of vendor risk.⁴⁰

Those five CIP-013 items make a ready-made checklist for any manufacturer's equipment contract, whether or not it is regulated.

TSA pipeline directives

TSA Security Directive Pipeline-2021-02G ("Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing," effective May 3, 2026 to May 2, 2027, read Oct. 28, 2026) applies to TSA-designated critical pipelines. Among its access control measures, it requires multifactor authentication or other controls that give comparable risk reduction, and an owner that does not use MFA on certain control room workstations must specify compensating controls. It also makes clear that owners stay responsible for contractors: "Both Owner/Operators and Authorized Representatives are liable for non-compliance on the part of the Authorized Representative."⁴¹

Defense suppliers and contract flow-down

Manufacturers that handle covered defense information under DFARS 252.204-7012 must meet NIST SP 800-171 Revision 2 and report cyber incidents to the Defense Department within 72 hours, and subcontractors carry the same duties up the chain (as of DFARS Class Deviation 2026-O0025, Rev. 3, Sept. 3, 2026).⁴² Remote access by an IT or OT service provider into a system holding that information is within scope. Lesson 6 explains CMMC and the July 2026 suspension of its Phase 2.

Vendors, integrators and the contracts that bind them

General vendor risk management, including tiering vendors, due diligence and standard contract clauses, is taught in Vendors, Contracts and Third-Party Risk (Module 73). This section adds what is different when the vendor builds, programs or services the machines that make your product.

Plants depend on three kinds of outside help. Product suppliers make the PLCs, drives, HMIs, software and machines. System integrators design and program the control system and tie the pieces together. Maintenance service providers keep it running, often under a long-term contract with remote support. The ISA/IEC 62443 series uses nearly the same roles: product supplier, integration service provider and maintenance service provider, alongside the asset owner who is accountable for the system.²⁷ Each one can bring risk in, and each one is also often the only party who fully understands how the system works.

The September 2026 integrator fact sheet

On Sept. 23, 2026, CISA and the FBI published "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators." It warns owners to "maintain caution when granting third-party ICS integrators high levels of access or control over industrial processes," applying least privilege, which it defines as giving users and systems "only the minimum access necessary to perform their assigned tasks, and no more."⁵ It notes that integrators who operate and host data outside the United States "may pose additional risks."⁵

It gives four questions for every integrator risk assessment:

1. What organizational data does the integrator store or have access to? (Network designs, device specifications and logs are all useful to an attacker.)
2. Where is the data stored?
3. Does the integrator have remote access for operational support? If so, an attacker who breaks into the integrator could "pivot into the utility's network."
4. Can the organization operate independently if the integrator is compromised?⁵

And five recommendations: put cybersecurity and supply chain cybersecurity in contracts and service agreements; evaluate and minimize devices with internet exposure; monitor and log remote access, using on-demand access where possible; request an inventory of all integrator-supplied software and hardware and how it connects and will be updated; and practice manual operations, accounting for where third parties fit into recovery.⁵ The contract topics it lists are a good outline for the vendor requirements sample at the end of this lesson: data storage locations and protection of ICS data and design documents; remote access capabilities; the basics of the integrator's security program; change and patch management; steps taken to secure deployed components "(e.g., changing default passwords, disabling unused ports)"; a list of authorized personnel with access; and processes that allow local engineering support so the plant is not wholly dependent on the integrator.⁵

The case the fact sheet cites, the 2025 intrusion at a U.S. automation company in which about 800 files of customer SCADA information were packaged for presumed theft, is worth sitting with. The integrator's customers did nothing wrong in their own plants. Their exposure was the integrator's file server. Ask your integrators how they protect your drawings, programs and passwords, and whether they keep copies they do not need.

ISA/IEC 62443-2-4 for service providers

Part 2-4 of the 62443 series sets security program requirements for integration and maintenance service providers. ISA lists the U.S. version as ANSI/ISA-62443-2-4-2018 (which adopts IEC 62443-2-4:2015 plus its 2017 amendment); the IEC published a second edition in 2023.²⁶⁴³ In plain terms, it describes the capabilities a buyer can expect a service provider to have, such as how it manages its own staff's access, handles remote access, protects the owner's data, manages patches and malware protection on what it installs, and documents what it delivers. Its requirements are graded with maturity levels, from ad hoc to continuously improving, so a buyer can ask for a level rather than a yes or no.⁴³

How to use it without buying the standard: ask service providers whether they have assessed themselves against 62443-2-4 or been certified, and request the summary. Write in the contract that the provider will maintain a security program "consistent with ISA/IEC 62443-2-4" and describe the specific items you care about most (named accounts, MFA, on-demand access, logging, data protection, secure handover of credentials). NIST's manufacturing extension partnership points small manufacturers to ISASecure, the program that certifies OT components, systems and organizations to the ISA/IEC 62443 standards and lists the certified products.⁴⁴

What to put in a contract

The strongest time to get security terms is before the purchase order is signed. After that, every change is an add-on with a price. Pull clauses from four places: the integrator fact sheet topics above; the five CIP-013 vendor items (incident notification, access revocation notice, vulnerability disclosure, software integrity, remote access coordination)³⁰; Secure by Demand's product elements (next section); and your own remote access policy, so the vendor agrees in advance to work through your jump host and approval process. The 2026 connectivity principles add a practical point: build flexibility into contracts so the plant can change how remote access works later without breaking the support agreement.⁴ And remember NIST's caution that modem or always-on access may be written into the service level, so changing the access may mean changing the contract too.²

Have your purchasing lead, your compliance officer and your controls engineers review the security terms together. The engineers know what the machine needs; purchasing knows what the vendor will accept; compliance knows what any regulator or customer requires you to flow down.

Secure by Demand: questions to ask before you buy

On Jan. 13, 2025, CISA, the NSA, the FBI, the EPA, TSA and partners in Australia, Canada, the European Commission, Germany, the Netherlands, New Zealand and the United Kingdom published "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products." Its key observation is that attackers "target specific OT products rather than specific organizations," so a weakness in a popular product exposes every plant that bought it.¹⁸ It lists 12 security elements buyers should prioritize and gives sample questions for each. The ones most tied to remote access and the supply chain are shown in the chart below.

A few details from the guide matter most for remote access. Under Secure by Default, it calls eliminating default passwords "vital for passwords for remote access."¹⁸ Under Ownership, it asks: "Does the manufacturer allow for support contracts with local engineering firms?" and whether the warranty allows adding firewalls, gateways, continuous monitoring or diodes, and it flags warning signs such as "A manufacturer selling device security functionality as an additional service."¹⁸ Under Vulnerability Management, it asks "Has the manufacturer drawn up a software bill of materials?" and whether security advisories will be machine-readable.¹⁸ Under Upgrade and Patch Tooling, it asks for a move to a supported operating system "at no extra cost if the original operation system is soon to be no longer supported."¹⁸ Patching itself, and how to do it without stopping production, is covered in Lesson 5.

Secure by Demand is guidance, not law. Its authors say buyers who insist on these elements "will send a message to manufacturers," and that pressure is the point.¹⁸ A single small plant has little bargaining power with a global automation company. A purchasing consortium, a utility, a large customer or a state program has more.

The software and hardware supply chain

Remote access is a door. The supply chain is what you carry through the door yourself: the software, firmware, patches and devices you install because you trust the company that made them. Attackers have learned that compromising one supplier can reach thousands of customers at once.

SolarWinds, Havex and why trusted updates are a target

SolarWinds (2020). In December 2020 CISA issued Emergency Directive 21-01, ordering federal civilian agencies to "disconnect or power down SolarWinds Orion products immediately" after "a known compromise involving SolarWinds Orion products that are currently being exploited by malicious actors."⁴⁵ CISA's alert AA20-352A (Dec. 17, 2020) described activity beginning "in at least March 2020," in which the attacker placed a tampered component into the vendor's software so that it shipped, signed with the company's own legitimate code-signing certificate, to customers who installed normal updates.⁴⁶ Orion is IT network monitoring software, not OT, but many industrial companies ran it, and the lesson carries over: a signed update from a real vendor can still be malicious if the vendor's own build process was compromised.

Havex (2012 to 2014). The industrial version came earlier. According to the Justice Department's 2022 indictment of three Russian FSB officers, a campaign known as Dragonfly included a supply chain attack in which malware was hidden in legitimate ICS software updates, infecting more than 17,000 devices.⁴⁷ Plants that did the right thing, downloading updates from their vendors' websites, were the ones infected.

Neither case means "stop patching." Unpatched systems are a bigger and more common risk. They mean: check what you install, know what is inside it, and watch how it behaves after installation.

SBOMs and the 2026 Minimum Elements

A software bill of materials (SBOM) is, in CISA's words, "a formal record that serves as an 'ingredients list' for software."⁴⁸ Modern software is built from many components, much of it open-source code written by others. When a flaw is found in a common component, an SBOM lets a plant answer, in hours instead of weeks, "Do we have that inside any of our HMIs, historians or engineering tools?" The 2023 remote access software guide recommends using SBOMs "to maintain an inventory of components within a software product."¹⁹

The U.S. definition of what an SBOM must contain has changed:

• In 2021 the National Telecommunications and Information Administration (NTIA) published the first "Minimum Elements for a Software Bill of Materials."
• In August 2025 CISA released a public comment draft proposing new fields, including component hash, license, tool name and generation context.⁴⁹
• On July 29, 2026, CISA, the NSA and the FBI, with 15 partner agencies from 13 other countries, among them Australia, Canada, Germany, France, Japan and Korea, published the final "2026 Minimum Elements for a Software Bill of Materials (SBOM)." It "updates and replaces" the NTIA document.⁶

The 2026 version's table of data fields lists 17 fields. Besides the familiar ones (component name, version, producer, identifiers, dependency relationships, SBOM author and timestamp), it adds a component hash algorithm and hash value (a fingerprint that lets you confirm a file is the one listed), the component license, the name and version of the tool that generated the SBOM, the "generation context" (the point in the software's life when the SBOM was made, such as at build time or after release), and an SBOM author signature.⁶ It removed the old separate "Access Control" element and replaced the "Automation Support" element with a "Machine-Processable Data" practice, dropping SWID tags as an accepted format.⁶ CISA's announcement noted more emphasis on machine-processable formats and coverage of open source, AI and software-as-a-service.⁴⁸ The document's key actions are short: organizations "should request SBOMs that satisfy the updated SBOM Minimum Elements" and use tools to ingest and analyze them.⁶

Two practical notes for plants. First, the SBOM document observes that the European Union's Cyber Resilience Act requires manufacturers of products with digital elements to provide an SBOM as part of their technical documentation, so equipment makers selling in Europe will be producing them anyway; asking for a copy costs them little.⁶ Second, an SBOM is only useful if someone reads it. A small plant does not need SBOM software on day one. It needs the SBOM on file, so that when CISA publishes an advisory about a component, the plant or its integrator can search the file. Secure by Demand also asks for a hardware bill of materials (HBOM), listing chips and boards, which matters for firmware-level flaws.¹⁸

Firmware and software integrity

Integrity means the file you install is exactly the file the vendor meant to ship, unchanged. The working tools are simple to describe:

• Get software from the source. Download firmware and patches from the vendor's official portal or receive them on media from the vendor, not from forums, email attachments or a technician's personal drive.
• Check the signature or hash. Many vendors digitally sign firmware or publish a hash (a fingerprint) for each file. Confirm it before installation. NERC's CIP-013 requires utilities' procurement processes to address "Verification of software integrity and authenticity of all software and patches provided by the vendor."³⁰
• Prefer devices that check for themselves. Some newer controllers refuse firmware that is not signed by the maker. That is a good question for the Secure by Demand conversation.
• Keep known-good copies. Store offline backups of PLC programs, configurations and the software needed to reload them. AA26-097A says to "Create and test strong backups of the logic and configurations of PLCs" and store them offline.¹¹ When a program looks wrong, compare it with the known-good copy.
• Remember SolarWinds. A valid signature proves who signed a file, not that the signer's own systems were clean. Watch new software after installation, and report anything odd to the vendor and to CISA.

Patching and installing firmware on running plant equipment carries its own safety risk. Plan every update with the equipment vendor, the safety lead and qualified engineers, and test it first; Lesson 5 explains how.

CyTRICS and the Idaho National Laboratory

Idaho has an unusual role here. The Department of Energy's CyTRICS program (Cyber Testing for Resilient Industrial Control Systems), sponsored by DOE's Office of Cybersecurity, Energy Security, and Emergency Response (CESER), is hosted at cytrics.inl.gov. Its home page states its aim as "Strengthening the cyber resilience of critical energy technologies through collaboration, research, and testing." It identifies critical energy technologies, evaluates their component makeup and cyber supply chain risks, uses "Bill of Materials (BOM) analysis," and works to "support timely, effective, and responsible vulnerability disclosure, mitigation, and product improvement." It draws on "expertise from six DOE national laboratories." Industry partners listed on its site include Hitachi Energy, Rockwell Automation, Schneider Electric and Schweitzer Engineering Laboratories, with GE Vernova also named.⁵⁰ (CyTRICS's site is on an INL web address; this lesson did not confirm wording that calls INL the program's "lead" laboratory.)

In practice, CyTRICS tests the kinds of components that end up in substations and plants, so that flaws are found and fixed by the maker before thousands of utilities and manufacturers install them. That is supply chain security at the source. It is energy-focused, but many of the same PLCs, relays and drives are used in manufacturing.

INL also hosts training that Idaho manufacturers can use. CISA's ICS301 "Advanced Cybersecurity for Industrial Control Systems" is a four-day, in-person course at "a facility in Idaho Falls, Idaho," with no tuition, including a red team versus blue team exercise; the online ICS300 course is a prerequisite.⁵¹ INL says the course has "hosted more than 200 sessions."⁵² NIST's manufacturing extension partnership also points small manufacturers to Malcolm, a free network traffic analysis tool suite from INL and CISA that understands many industrial protocols and can help a plant see who is talking to its control network, including remote sessions.⁴⁴

Small-shop realities: one vendor, one laptop, one modem

Idaho's manufacturing sector employed about 77,500 people in September 2026 (preliminary, seasonally adjusted), roughly 8.7 percent of the state's nonfarm jobs, and most Idaho manufacturers are small.⁵³ Verizon found that more than 90 percent of the breached manufacturers in its data were small and mid-size businesses with fewer than 1,000 employees.¹⁵ A small plant rarely has a security team, a DMZ or a jump host. What it often has is this: one machine builder who supports the main line remotely, one maintenance laptop that holds every PLC program, and one cellular modem in a panel that the integrator installed years ago.

That setup can be made much safer without buying much. In rough order of value:

1. Know the three things. Write down the vendor's remote method, where the modem is, and where the laptop lives. Put a label on the modem saying what it is, who uses it and who to call.
2. Keep the modem off until needed. Many small plants put the modem on a keyed switch or a plug that maintenance turns on when the vendor calls and off when the job is done. That is a manual version of the just-in-time access NIST and the 2026 principles describe.²⁴ Check with the vendor first that the machine does not need the connection for normal operation.
3. Change the default passwords on the modem and on anything reachable through it, and do not share them by email. CISA's second primary mitigation is "Change default passwords immediately and use strong, unique passwords."³
4. Ask the vendor for MFA and named accounts on its remote tool, and ask that it connect only when you approve. Many commercial remote support products have these features turned off by default.
5. Treat the maintenance laptop like the keys to the plant. Keep it for plant work only: no email, no web browsing, current patches, full-disk encryption, a strong sign-in, and stored in a locked place. Keep an offline copy of every PLC program it holds.
6. Keep a simple log. A notebook or spreadsheet: date, vendor person, what they did, who watched. It is not fancy, but it answers "what changed?"
7. Practice running without help. Know which machines can run in manual and who knows how. CISA's fifth mitigation applies to small plants as much as big ones.³
8. Use the free help. CISA's free external vulnerability scanning shows what the outside world can see; its free CSET desktop tool walks owners through an OT and IT self-assessment.²¹ TechHelp, "Idaho's official Manufacturing Extension Partnership Center," based at Boise State University with Idaho State University, the University of Idaho and the Idaho Manufacturing Alliance, received a new NIST cooperative agreement in March 2026 to keep serving Idaho manufacturers; ask it what cybersecurity help it currently offers, since its announcement did not list specific cyber services.⁵⁴ NIST's MEP program can be reached at mepcyber@nist.gov.⁵⁵

Each of these touches running equipment or a vendor arrangement. Talk with the vendor and whoever is responsible for safety before changing anything, and try it during a planned stop rather than mid-shift.

Sample policies

The two samples below put the principles in this lesson into policy language. They are written for a mid-size plant and can be shortened for a small one. The general policy and vendor management basics they build on are in Module 73.

Common mistakes

• Forgetting old accounts. Colonial's way in was a "legacy VPN profile that was not intended to be in use."⁸ Old vendor and employee remote accounts should be found and disabled; CISA says to "disable dormant accounts."³
• Relying on a password alone. The same Colonial account "did only have single-factor authentication."⁸ A complicated password did not help once it was known.
• Leaving controllers reachable from the internet. The 2023 Unitronics defacements and the 2026 PLC disruptions both hit devices that answered directly from the internet, some still using default credentials.¹⁰¹¹
• Not knowing where the modems are. During the July 2026 water attacks, utilities had to find and disconnect cellular-connected equipment under pressure.¹³ An inventory made in calm times is faster.
• Trusting legitimate tools blindly. In Ukraine in 2015, attackers used the utilities' own remote administration tools and VPN-connected ICS software to open breakers.⁹ A remote tool being "ours" does not mean the person using it is.
• Thinking of the integrator as outside the risk. In 2025 an integrator's network held about 800 files of customer SCADA details that foreign actors packaged for theft.⁵ Your data at the vendor is part of your attack surface.
• Making the jump host a single weak point. Dragos's case data point at "compromised VPN or jumphost credentials" in 73 percent of all-time cases.¹ A jump host with a password-only login and broad reach is a gift to attackers.
• Removing access without warning the vendor or operations. A sudden cut can break a support agreement or a process that quietly depends on the link. NIST warns that removing modems "may require contracts to be renegotiated."² Plan, communicate and test.
• No way to run without the vendor. The integrator fact sheet's question, "Can the organization operate independently if the integrator is compromised?", has embarrassed many plants that found they had no current program backups or no one who knew manual operation.⁵

Questions people ask

Our vendor says its remote tool is encrypted. Isn't that enough?

No. Encryption keeps outsiders from reading the session in transit. It does nothing about who is logging in, whether that login was stolen, whether the tool is always on, or what the session can reach. The 2023 remote access software guide notes that end-to-end encryption in remote tools can even help an intruder slip files past the firewall.¹⁹ Ask about named accounts, MFA, on-demand access, logging and how the plant can see and end sessions.

We are air-gapped. Does this apply to us?

Maybe less than to others, but check. Many plants that call themselves air-gapped find a cellular modem, a vendor laptop that also connects to the internet, a USB drive that travels between networks, or a cloud-connected machine. The inventory steps in this lesson are how you prove the gap is real. Even real gaps have to be crossed for updates and programs, so the integrity and media controls still apply.

Isn't a VPN a secure remote access solution?

A VPN is an encrypted tunnel, which is one piece. Colonial's attacker came through a VPN, and Ukraine's breakers were operated through one.⁸⁹ A VPN that drops a remote user directly onto the control network with a password alone is a risk. A VPN with phishing-resistant MFA that lands only on a jump host in the DMZ, for an approved window, with logging, is a reasonable design. CISA's 2025 fact sheet and 2026 advisory both pair the VPN with MFA, least privilege and limits on what it reaches.³¹¹

What is the difference between a jump host and a remote access gateway?

The gateway is where a remote user connects and proves who they are, usually with MFA. The jump host is the computer in the DMZ they then work from, which has the approved tools and is the only thing allowed to reach into OT. Some commercial products combine both functions; what matters is that the remote user's own device never connects directly to OT, and that every session is authorized, limited, logged and can be ended.

Can we make the vendor pay for this?

Sometimes. Secure by Demand urges buyers to expect logging, strong authentication and patches as part of the base product, not paid extras, and flags "A manufacturer selling device security functionality as an additional service" as a warning sign.¹⁸ Your bargaining power is greatest before the purchase order. For existing contracts, the next renewal is the moment to add terms. For the plant's own gateway and jump host, the cost is usually the plant's.

Do we need an SBOM if we cannot read one?

Yes, keep it on file. When a widely used component turns out to have a serious flaw, the plants with SBOMs can search them, or ask their integrator to. The plants without them have to call every vendor and wait. CISA's 2026 Minimum Elements tell organizations to "request SBOMs that satisfy the updated SBOM Minimum Elements."⁶

What should a small shop do first?

Find the remote paths, turn off the ones nobody needs, change default passwords, and make the vendor's connection something you turn on when needed instead of something always on. The small-shop list above is in order. Then call TechHelp or CISA about free assessments.⁵⁴²¹

Does a regulator require this for an ordinary factory?

For most private manufacturers, no federal rule dictates how the plant floor's remote access must work as of Oct. 28, 2026. Rules apply to specific sectors (bulk power, designated pipelines, defense information, and others covered in Lesson 6), and customers, insurers and contracts increasingly impose their own requirements. This lesson uses the regulated sectors as examples of what is workable, not as rules for everyone.

Hard questions

Should plants ban vendor remote access altogether?

The case for a ban: remote access is the most common way in, according to every data source in this lesson, and a door that does not exist cannot be opened. CISA's July 2026 announcement of CI Fortify calls physical isolation "the most risk-effective solution."³⁴ Some high-consequence sites already require vendors to come on site.

The case against: controls specialists are scarce, many plants are far from their vendors, and slow repairs have their own costs and safety risks. A ban can also push people to quiet workarounds, such as a hidden modem, that are worse than a managed connection. NIST's position is not a ban but "only if justified and limited to what is required for the business need."²

What the evidence shows: the incidents in this lesson involved access that was unknown, always on, password-only or exposed to the internet. None of the government guidance reviewed here calls for banning remote access; all of it calls for limiting, brokering, supervising and logging it, with the ability to cut it off. Whether a given plant should go further depends on what could happen if a session were misused.

Should secure remote access be required by law for all manufacturers?

The case for: voluntary guidance has existed for years, yet internet-exposed PLCs were still being disrupted in 2026, and small plants that are attacked can harm workers, neighbors and supply chains. The power sector's CIP-003-9 shows that even low impact sites can be required to identify, disable and watch vendor remote access.³⁹

The case against: manufacturing is enormously varied, from a two-person machine shop to a chemical plant, and one rule rarely fits. Compliance costs fall hardest on small firms; the Defense Department suspended CMMC Phase 2 in July 2026 citing "prohibitive compliance costs and unacceptable bureaucratic burdens, especially to small businesses."⁵⁶ Supporters of the voluntary approach argue that customer contracts, insurance requirements and free government help can move practice without a new mandate.

What the evidence shows: regulated sectors such as electricity have specific, auditable remote access controls; this lesson found no study comparing incident rates in regulated and unregulated manufacturers that would settle the question. Lesson 6 covers the arguments about each sector rule in detail.

Should equipment makers carry more of the responsibility?

The case for: Secure by Demand observes that attackers "target specific OT products rather than specific organizations," and that many products have "weak authentication, known software vulnerabilities, limited logging, insecure default settings and passwords, and insecure legacy protocols."¹⁸ A single maker fixing a default password protects thousands of plants at once; the European Union's Cyber Resilience Act takes that approach for products sold there, including SBOM documentation.⁶

The case against: makers point out that plants often run equipment for decades, decline upgrades, and configure products insecurely themselves; integrators and owners make many of the decisions that create exposure. Shifting liability could raise prices and slow product releases, and small makers may struggle with the same compliance costs that worry small plants.

What the evidence shows: the 2023 and 2026 PLC campaigns depended both on product features (default credentials, internet-reachable services) and on owner and integrator choices (connecting devices to the internet).¹⁰¹¹ Responsibility is shared in practice. The open question is how much each party should bear, and that is a policy choice.

Are SBOMs worth the effort for plants?

The case for: an SBOM turns "are we affected?" from a weeks-long phone campaign into a search. Eighteen government agencies from 14 countries co-authored the 2026 Minimum Elements, and the EU now requires SBOMs as technical documentation for products in its market.⁶

The case against: many plants lack the tools or staff to use SBOMs, older equipment will never have one, and an SBOM lists components without saying whether a flaw is actually reachable in a given product, which can produce false alarms.

What the evidence shows: the 2026 document itself stresses machine-processable data and tools to "generate, ingest, and analyze SBOM data," acknowledging that value depends on use.⁶ For a plant, the low-cost step is to ask for SBOMs on new purchases and keep them; deeper use can come later or through an integrator.

Where to go next

• CISA free Cyber Hygiene services and CSET: Free from CISA for U.S. organizations, including small manufacturers and utilities. Vulnerability scanning shows what your organization exposes to the internet; CSET is a free desktop self-assessment tool for OT and IT. Sign up through the page and run CSET with your controls and IT staff together.
• Secure connectivity principles for OT (NCSC-UK, CISA, FBI and partners, 2026): Free government guidance for OT owners and engineers. Eight principles for designing remote and external connections, with practical detail on brokered access, jump hosts, just-in-time access and isolation plans. Use it as a checklist when reviewing your remote access design.
• Secure by Demand for OT buyers (Jan. 13, 2025): Free. For purchasing staff, engineers and owners buying OT products. Twelve security elements with questions to ask suppliers; copy the questions into requests for proposal and vendor meetings.
• CISA ICS training (ICS301 in Idaho Falls and online courses): No tuition. For control system engineers, operators and IT staff. Start with CISA's free online ICS courses; ICS301 is a four-day hands-on course in Idaho Falls with a red team versus blue team exercise and requires the online ICS300.
• NIST MEP: Cybersecurity resources for manufacturers: Free guidance for small and mid-size manufacturers, organized by the NIST Cybersecurity Framework, with links to CSET, Malcolm and ISASecure. In Idaho, the state MEP center is TechHelp at Boise State University; ask what cybersecurity help is currently offered.
• CISA SBOM resources and the 2026 Minimum Elements: Free. For buyers, engineers and software makers. Defines the data an SBOM should contain; use it to word SBOM requirements in purchase contracts.
• FBI and CISA third-party ICS integrator fact sheet: Free, four pages. For owners who rely on integrators. Use its four risk questions and its list of contract topics before signing or renewing an integration or support agreement.

Still being checked (6 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The July 1, 2028 effective date for CIP-005-8 is calculated from FERC Order No. 919's implementation language, not read on NERC's effective-dates page.
• CISA's "Implementing Phishing-Resistant MFA" fact sheet PDF did not load; its description of FIDO and PKI methods is from its title and widely published summaries.
• Whether INL is formally the "lead" laboratory for CyTRICS was not confirmed; the CyTRICS home page (read Oct. 28, 2026) names no lead laboratory, and the program is hosted on an inl.gov address and draws on six DOE national laboratories.
• TechHelp's current cybersecurity services were not confirmed.
• Colonial Pipeline's restart date is not stated in this lesson because it was not confirmed in a primary record.
• The IBM X-Force 2026 initial access percentages (32, 16 and 11 percent) are taken from Manufacturing Dive's report; whether IBM computed them for all incidents or for manufacturing alone was not confirmed in IBM's own report.

Last verified October 28, 2026. General education, not legal, engineering, safety or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Dragos, "2026 OT Cybersecurity Year in Review" (blog summary, Feb. 17, 2026): "73 percent of all-time IR cases involved compromised VPN or jumphost credentials"; 81 percent of assessments found poor IT/OT segmentation; 46 percent found adequate OT network monitoring. Industry report (read Oct. 28, 2026). Read it online. ↩
2. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Sec. 6.2.10 "Remote Access," pp. 122 to 124 (read Oct. 28, 2026). Read it online. ↩
3. CISA, FBI, EPA and DOE, "Primary Mitigations to Reduce Cyber Threats to Operational Technology," TLP:CLEAR fact sheet, May 6, 2025 (read Oct. 28, 2026). Read it online. ↩
4. NCSC-UK with CISA, FBI, ASD's ACSC, Canadian Centre for Cyber Security, BSI, NCSC-NL and NCSC-NZ, "Secure connectivity principles for operational technology (OT)," January 2026 (Crown copyright 2026), principles 1 to 8 and guidance on brokered connections, outbound connections, just-in-time access, break-glass accounts and monitoring (read Oct. 28, 2026). Read it online. ↩
5. FBI and CISA, "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators," TLP:CLEAR fact sheet, Sept. 23, 2026, pp. 1 to 4 (including the FBI account of the March to April 2025 intrusion at a U.S. industrial automation company) (read Oct. 28, 2026). Read it online. ↩
6. CISA, NSA, FBI and 15 partner agencies, "2026 Minimum Elements for a Software Bill of Materials (SBOM)," July 29, 2026 (version 2.1), Guidance at a Glance, Introduction, Appendix A (Table 1, data fields) and Appendix B (changes from 2021) (read Oct. 28, 2026). Read it online. ↩
7. NIST SP 800-82 Rev. 3, September 2023, Appendix C, table of OT policy and procedure vulnerabilities, "Poor remote access controls" (read Oct. 28, 2026). Read it online. ↩
8. U.S. Senate Committee on Homeland Security and Governmental Affairs, "Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyber Attack," S. Hrg. 117-429, June 8, 2021, testimony of Joseph Blount (read Oct. 28, 2026). Read it online. ↩
9. CISA (ICS-CERT), ICS Alert IR-ALERT-H-16-056-01, "Cyber-Attack Against Ukrainian Critical Infrastructure," Feb. 25, 2016, updated July 20, 2021 (read Oct. 28, 2026). Read it online. ↩
10. FBI, CISA, NSA, EPA and Israel National Cyber Directorate, Joint Cybersecurity Advisory AA23-335A, "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities," Dec. 1, 2023 (read Oct. 28, 2026). Read it online. ↩
11. FBI, CISA, NSA, EPA, DOE, USCYBERCOM Cyber National Mission Force and partners, Cybersecurity Advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," April 7, 2026, updated July 22, 2026 (Key Actions and Mitigations) (read Oct. 28, 2026). Read it online. ↩
12. TechCrunch, "CISA confirms hackers targeted over 100 US water systems during July," Aug. 26, 2026. Press report (read Oct. 28, 2026). Read it online. ↩
13. Tenable, "Coordinated cyberattack on Minnesota water utilities: what you need to know," 2026 (Braham, Plymouth and Maple Plain, July 26 to 27, 2026). Industry report (read Oct. 28, 2026). Read it online. ↩
14. Manufacturing Dive, "Manufacturing sector saw most cyberattacks in 2025: IBM X-Force," Feb. 26, 2026, reporting the IBM X-Force Threat Intelligence Index 2026. Press report (read Oct. 28, 2026). Read it online. ↩
15. Verizon, "2025 Data Breach Investigations Report," Manufacturing (NAICS 31-33), pp. 79 to 80 (read Oct. 28, 2026). Read it online. ↩
16. CISA, Known Exploited Vulnerabilities Catalog, JSON feed, catalog version 2026.10.27 (1,760 entries); vendor-name count by the module's research team found only a few entries for OT makers (Siemens 2, Rockwell 1, Schneider Electric 1, Unitronics 1, Delta Electronics 1) (read Oct. 28, 2026). Read it online. ↩
17. NIST SP 800-82 Rev. 3, September 2023, Sec. 6.2.1.4, authentication and multi-factor authentication, OT-specific recommendations (read Oct. 28, 2026). Read it online. ↩
18. CISA, NSA, FBI, EPA, TSA, ASD's ACSC, CCCS, European Commission DG CONNECT, BSI, NCSC-NL, NCSC-NZ and NCSC-UK, "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products," Jan. 13, 2025, pp. 3 to 4 and element sections (Logging in the Baseline Product, Ownership, Secure by Default, Strong Authentication, Vulnerability Management, Upgrade and Patch Tooling) (read Oct. 28, 2026). Read it online. ↩
19. CISA, NSA, FBI, MS-ISAC and Israel National Cyber Directorate, "Guide to Securing Remote Access Software," June 6, 2023, pp. 2 to 8 (read Oct. 28, 2026). Read it online. ↩
20. CISA, EPA, NSA, FBI and international partners, "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators," Aug. 13, 2025 (read Oct. 28, 2026). Read it online. ↩
21. CISA, "#StopRansomware: Services" (free Cyber Hygiene Vulnerability Scanning, CSET and other services) (read Oct. 28, 2026). Read it online. ↩
22. NIST, "Guide to Operational Technology (OT) Security: NIST Requests Comments on Draft SP 800-82r4," Sept. 21, 2026 (comments through Nov. 30, 2026) (read Oct. 28, 2026). Read it online. ↩
23. NIST SP 800-82 Rev. 3, September 2023, Sec. 3.3.7, "Develop a Maintenance Tracking Capability" (read Oct. 28, 2026). Read it online. ↩
24. NIST SP 800-82 Rev. 3, September 2023, Appendix F (OT Overlay), control AC-17 Remote Access, OT discussion and rationale for adding AC-17(9) to the low, moderate and high baselines, p. 233 (read Oct. 28, 2026). Read it online. ↩
25. Canadian Centre for Cyber Security, "Joint guidance on secure connectivity principles for operational technology," Jan. 12, 2026 (lists co-authors; describes the end-states as "goals rather than minimum requirements") (read Oct. 28, 2026). Read it online. ↩
26. International Society of Automation, "ISA/IEC 62443 Series of Standards" (list of published parts, including ANSI/ISA-62443-2-4-2018) (read Oct. 28, 2026). Read it online. ↩
27. ISA Global Cybersecurity Alliance, "Quick Start Guide: An Overview of ISA/IEC 62443 Standards," June 2020 (roles, zones and conduits, foundational requirements) (read Oct. 28, 2026). Read it online. ↩
28. CISA, "CISA Releases Guidance on Phishing-Resistant and Numbers Matching Multifactor Authentication," bulletin, Oct. 31, 2022 (read Oct. 28, 2026). Read it online. ↩
29. CISA, "Implementing Phishing-Resistant MFA" fact sheet, October 2022 (describes FIDO/WebAuthn and PKI-based authentication as phishing-resistant). The PDF did not load on Oct. 28, 2026; its title and link were confirmed in search results (read Oct. 28, 2026). Read it online. ↩
30. NERC Reliability Standard CIP-013-2, Requirement R1, Part 1.2 (subparts 1.2.1 to 1.2.6), as reproduced in NERC Project 2019-03, "CIP-013-2 Implementation Guidance," Oct. 7, 2020 (read Oct. 28, 2026). Read it online. ↩
31. NIST SP 800-82 Rev. 3, September 2023, Executive Summary, p. 4 (read Oct. 28, 2026). Read it online. ↩
32. NIST SP 800-82 Rev. 3, September 2023, Appendix E.1.2, unidirectional gateways (read Oct. 28, 2026). Read it online. ↩
33. CISA, "Adapting Zero Trust Principles to Operational Technology," bulletin announcing joint guidance with the Department of War, DOE, FBI and State Department, April 29, 2026 (read Oct. 28, 2026). Read it online. ↩
34. CISA, "CI Fortify: Advice for isolating vital systems," bulletin announcing joint guidance with ASD's ACSC, FBI and partners, July 28, 2026 (read Oct. 28, 2026). Read it online. ↩
35. FERC, "Commission Information Collection Activities (FERC-725B); Comment Request; Extension," 91 FR 64921, Oct. 13, 2026 (about 1,706 U.S. entities subject to CIP standards as of August 2026) (read Oct. 28, 2026). Read it online. ↩
36. NERC Reliability Standard CIP-005-7, "Cyber Security - Electronic Security Perimeter(s)," Requirement R2, Parts 2.1 to 2.3 (Intermediate System, encryption terminating at the Intermediate System, multi-factor authentication for all Interactive Remote Access sessions) and Parts 2.4 and 2.5; see also Texas Reliability Entity, "Ask Texas RE CIPWG: CIP-005-7 R2 and R3," presentation, Feb. 7, 2025 (read Oct. 28, 2026). Read it online. ↩
37. NERC Project 2019-03, "CIP-005-7 Summary of Changes," Oct. 7, 2020 (Parts 2.4 and 2.5; Requirement R3, Parts 3.1 and 3.2) (read Oct. 28, 2026). Read it online. ↩
38. FERC Order No. 919, "Virtualization Reliability Standards," Docket RM24-8-000, issued March 19, 2026, 91 FR 13957 (March 24, 2026), effective May 26, 2026, approving CIP-005-8 among 11 modified standards; the implementation date of July 1, 2028 is calculated from the order's implementation language (read Oct. 28, 2026). Read it online. ↩
39. NERC Reliability Standard CIP-003-9, "Cyber Security - Security Management Controls," Requirement R1 Part 1.2.6 and Attachment 1, Section 6 (Vendor Electronic Remote Access Security Controls, Parts 6.1 to 6.3); effective date of April 1, 2026 as reported by Brandon Ware, pv magazine USA, April 22, 2026 (read Oct. 28, 2026). Read it online. ↩
40. FERC Order No. 912, "Supply Chain Risk Management Reliability Standards Revisions," 90 FR 45661, Sept. 23, 2025, effective Nov. 24, 2025 (read Oct. 28, 2026). Read it online. ↩
41. TSA, Security Directive Pipeline-2021-02G, "Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing," effective May 3, 2026 to May 2, 2027, sections II.A and III.C (read Oct. 28, 2026). Read it online. ↩
42. Department of Defense (Department of War), DFARS Class Deviation 2026-O0025, Revision 3, Sept. 3, 2026, with DFARS 252.204-7012 clause text (read Oct. 28, 2026). Read it online. ↩
43. Wikipedia, "IEC 62443" (lists IEC 62443-2-4 Ed. 2.0, 2023, and maturity levels used in Parts 2-4 and 4-1). Secondary source (read Oct. 28, 2026). Read it online. ↩
44. NIST Manufacturing Extension Partnership, "Cybersecurity Resources for Manufacturers: Where to Start" (ISASecure list of products certified to ISA/IEC 62443; Malcolm from INL and CISA) (read Oct. 28, 2026). Read it online. ↩
45. CISA, "CISA Issues Emergency Directive to Mitigate the Compromise of SolarWinds Orion Network Management Products," Dec. 13, 2020 (Emergency Directive 21-01) (read Oct. 28, 2026). Read it online. ↩
46. CISA, Alert AA20-352A, "Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations," Dec. 17, 2020, updated April 15, 2021 (read Oct. 28, 2026). Read it online. ↩
47. U.S. Department of Justice, "Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide," March 24, 2022 (read Oct. 28, 2026). Read it online. ↩
48. CISA, bulletin announcing the "2026 Minimum Elements for a Software Bill of Materials (SBOM)," July 29, 2026 (read Oct. 28, 2026). Read it online. ↩
49. CISA, "2025 Minimum Elements for a Software Bill of Materials (SBOM)," public comment draft, August 2025 (read Oct. 28, 2026). Read it online. ↩
50. U.S. Department of Energy CESER, CyTRICS (Cyber Testing for Resilient Industrial Control Systems) program site; the home page does not name a lead laboratory (read Oct. 28, 2026). Read it online. ↩
51. CISA, "Advanced Cybersecurity for Industrial Control Systems (ICS301)" course page (read Oct. 28, 2026). Read it online. ↩
52. Idaho National Laboratory, "Industrial Control Systems Cybersecurity Training" (read Oct. 28, 2026). Read it online. ↩
53. U.S. Bureau of Labor Statistics, Current Employment Statistics, Idaho manufacturing (SMS16000003000000001) and total nonfarm (SMS16000000000000001), seasonally adjusted, September 2026 preliminary: 77,500 and 890,100; the 8.7 percent share is the module's calculation (read Oct. 28, 2026). Read it online. ↩
54. Boise State University, "TechHelp receives federal award to continue supporting Idaho manufacturers," March 25, 2026 (read Oct. 28, 2026). Read it online. ↩
55. NIST MEP, "Cybersecurity Resources for Manufacturers" (updated Sept. 30, 2025; contact mepcyber@nist.gov) (read Oct. 28, 2026). Read it online. ↩
56. U.S. Department of War, "War Department Changes Cybersecurity Maturity Model Certification Requirements," July 13, 2026 (read Oct. 28, 2026). Read it online. ↩
57. Idaho Public Utilities Commission, agency website (no commission-level cybersecurity rule found) (read Oct. 28, 2026). Read it online. ↩
58. Idaho Statesman, via East Idaho News, Sept. 8, 2026, on Idaho's cyber readiness after the summer 2026 water utility attacks. Press report (read Oct. 28, 2026). Read it online. ↩