Manufacturing Identity and OT Access Guide

On most plant floors the people, machines and suppliers that can change a production process are identified by shared logins, default passwords and remote support tools that nobody owns. Manufacturing differs from other OT sectors because the line runs on shifts, machines arrive from original equipment manufacturers (OEMs) with their own accounts and remote access, and Industry 4.0 projects keep wiring the plant to ERP, cloud analytics and supplier portals. This guide covers identity and access for discrete and process manufacturers: plant roles, OEM and integrator access, engineering workstations, service accounts between MES, historian and ERP, and the regulatory expectations from IEC 62443, CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) and NIS2. It is written for plant OT engineers, site IT leads and the security teams who support them. Generic OT identity architecture is covered in the Identity for OT Environments Guide; this page stays with what is specific to manufacturing.

Key takeaways

Shift work drives shared accounts. HMI and SCADA stations left logged in as "operator" across three shifts are the norm; fix accountability with fast badge or PIN re-authentication at the station, not with long passwords nobody will type in gloves.
OEMs and integrators are the biggest identity population you do not control. Machine builders ship accounts, VPN boxes and cellular routers with the equipment. Contract for named users, brokered sessions and offboarding before the purchase order is signed.
The engineering workstation is the crown jewel. Whoever can sign in to it and open the PLC project can change the process (MITRE ATT&CK for ICS T0843 Program Download, T0836 Modify Parameter). Treat it as a privileged access workstation.
Industry 4.0 multiplies non-human identities. MES, historian, ERP connectors, IIoT gateways and cloud analytics agents all authenticate with service accounts, certificates or API keys that often outlive the project that created them.
The cost of getting it wrong is lost production, not just lost data. The Jaguar Land Rover incident of 2025 stopped vehicle production for more than five weeks. Plan identity controls, and their rollback, around production impact and safety.

Why manufacturing identity is different

Manufacturing networks combine a corporate IT estate, a plant network (often Purdue levels 3 and below) and a population of machines that each arrive as a small, vendor-managed system. Several features make identity harder than in an office estate or even a utility:

Shifts and shop-floor ergonomics: operators wear gloves, stations are shared, and a locked HMI during a line fault is a safety and quality problem. Interactive authentication must take seconds.
Machine-by-machine procurement: each packaging line, robot cell, CNC machine or skid comes with its own controller, local HMI accounts and often an OEM remote access path. The plant inherits dozens of small identity stores.
Long asset life: controllers and HMI operating systems stay in service for 15 years or more, so many devices support only local accounts, a single shared password or none at all.
High contractor share: maintenance contractors, integrators, calibration and validation specialists, and shutdown crews can outnumber employees during planned outages.
Converged IT and OT: MES, quality, historian and ERP integrations mean credentials and trust flow between domains. A single Active Directory shared by office and plant lets an IT compromise become a plant outage.

For the underlying OT architecture, see the OT Security Guide and the OT and ICS Identity and Access Guide.

Plant identity populations and how to control them

Population	Typical access today	Target control	Notes for the plant
Line operators	Shared HMI login per station or line, left signed in	Named identity with badge tap or short PIN at the HMI; role per line; auto-logoff tuned per station	Keep a view-only role that never locks so the process stays visible
Maintenance technicians	Shared "maint" account with elevated HMI rights	Named accounts, elevated role requested per work order, time-bound	Link elevation to the CMMS work order number for audit
Controls and process engineers	Local admin on engineering workstations, PLC project passwords shared by email	Separate OT admin account, MFA to the engineering workstation, project files in a controlled repository	Engineering workstation treated as a privileged access workstation
OEM and machine builder support	Always-on VPN or cellular router installed with the machine, shared vendor account	Brokered remote session, named vendor users, approval per session, recording	Disable the OEM's own modem once a brokered path exists
System integrators and project contractors	Domain accounts created for a project and never removed	Sponsored accounts with an end date, tied to a contract and project	Review at project close and at handover
Shutdown and turnaround crews	Bulk generic accounts or shared badges	Pre-provisioned, time-boxed accounts activated for the outage window	Bulk revoke on the last day of the outage
Service accounts (MES, historian, ERP, OPC UA clients)	Domain accounts with passwords that never change, often domain admin	Inventory, least privilege, managed passwords or certificates, owners	See the section on non-human identities
Machines and IIoT devices	Default credentials, no device identity	Unique credentials or certificates per device, enrolment at commissioning	See the Device and IoT Identity Guide

Shared HMI accounts and shift handover

Shared operator accounts are rarely laziness: they exist because a locked HMI during an upset is dangerous and because operators move between stations. The goal is accountability without slowing the line.

Separate viewing from acting: leave a shared, non-locking view role that can see alarms and trends, and require a personal re-authentication only for actions that change setpoints, recipes, modes or alarm acknowledgements.
Fast authenticators: RFID badge readers or a badge plus short PIN at the station usually work where passwords fail. Where the HMI cannot integrate a reader, document a compensating control such as shift log attribution.
Shift handover: make sign-out and sign-in part of the handover checklist. Monitor for actions logged under an operator who has badged out of the site.
Local HMI and panel passwords: machine panels often have built-in "operator", "maintenance" and "admin" levels with factory passwords printed in the manual. CPG 2.0 goal 3.A asks for default passwords to be changed before devices are connected, including OT; record the changed values in a vault, not on the panel.

IEC 62443-3-3 system requirement SR 1.1 expects each human user to be identified and authenticated. Where a component cannot do this, the standard's approach is to document compensating countermeasures for the zone rather than pretend the requirement is met. See the IEC 62443 Guide.

OEM, integrator and contractor access

Third parties are the identity problem manufacturers most often underestimate. Machine builders support their equipment remotely, sometimes through a router they installed and only they can administer. Integrators hold project credentials long after commissioning. The March 2025 intrusion into Jaguar Land Rover's Jira server described on the Jaguar Land Rover Cyberattack 2025 page used a third-party employee's credentials harvested by infostealer malware years earlier and still valid: a supplier account that nobody had rotated or expired.

Put identity in the purchase specification. Require, for every machine or system: a list of all accounts and default credentials, the ability to change them, support for named users or directory integration, documented remote access methods, and agreement to use the plant's remote access broker. IEC 62443-2-4 sets requirements for service providers to asset owners and is a useful reference for these clauses.
Close the OEM's own back door. Inventory cellular routers, VPN appliances and remote desktop tools that came with machines (asset discovery and a walk of the cabinets both help). Replace them with one brokered path through the industrial DMZ.
Name every vendor user. No shared "vendor" account. Vendor staff authenticate with phishing-resistant MFA where possible; CPG 2.0 goal 3.F calls out MFA for vendor, maintenance, remote engineering and HMI access and says that where MFA is not available, remote access should be removed or the asset more tightly segmented.
Approve per session. Sessions are requested against a work order, approved by the area owner or shift lead, limited to the target asset and recorded. The plant can see and terminate the session.
Expire by default. Contractor and integrator accounts carry an end date tied to the contract; CPG 2.0 goal 3.D asks for contractors and vendors to be offboarded and for inactive accounts to be disabled.

See the Third-Party Access Guide and the OT Remote Access Guide.

Engineering workstations and controller access

An engineering workstation with the vendor programming software and the plant's project files can download logic to a PLC, change its operating mode or alter parameters. Those are ATT&CK for ICS techniques T0843 Program Download, T0858 Change Operating Mode and T0836 Modify Parameter, and each depends on access to that workstation and to the controller. Controls that matter:

Dedicated OT admin accounts: engineers use a separate account for engineering work, never their office account. CPG 2.0 goal 3.G asks administrators to keep separate user and privileged accounts, and goal 3.C asks for separate credentials across IT and OT.
MFA at the workstation or the jump host: if the engineering workstation sits in the control zone, require MFA at the jump host that reaches it; remote engineering always goes through the broker.
Project and controller passwords: many controllers support project passwords, controller access levels or key switches. Use them, store the values in a vault with check-out, and change them when an integrator leaves.
Physical mode switches: where controllers have a run or program key switch, keep them in run and control the keys as you would a privileged credential.
Removable media: engineers often move project files by USB. T0847 Replication Through Removable Media is a known initial access route; use a scanning kiosk and a controlled file transfer path. CPG 2.0 goal 3.R asks organisations to prohibit connection of unauthorised devices.

See the PLC Security Guide and the Privileged Access Management Guide.

Non-human identities in Industry 4.0

Smart factory projects connect the plant to the business and the cloud, and each connection is an identity. Typical examples are MES, historian, OPC UA, ERP, IIoT gateway and analytics agent identities.

Non-human identity	Common weakness	Control
MES and historian service accounts	Domain admin or local admin, password unchanged since install, used interactively by engineers	Least privilege per interface, deny interactive logon, managed password (for example a group managed service account where the application supports it), named owner
OPC UA application certificates	Self-signed certificates auto-trusted, security mode "None" left enabled	Require signed and encrypted security modes, manage the trust list, set expiry and renewal ownership
IIoT gateway and cloud device credentials	Shared key across all gateways, embedded in images	Unique per-device credentials or certificates enrolled at commissioning, revocation on decommission
ERP and supply chain integrations	API keys with broad scopes stored in scripts on plant servers	Secrets in a vault, scoped tokens, rotation, logging of use
Analytics and AI agents	Read access drifts into write access to setpoints	Separate read and write identities; any write path requires human approval and stays inside the control zone

Inventory these with the same rigour as people: owner, purpose, systems reached, credential type and last rotation. See the Service Account Security Guide and the Industrial IoT (IIoT) Security Guide.

Separating IT and OT identity

A frequent design decision is whether the plant should trust the corporate directory. The choice depends on size and maturity:

Option	When it fits	Trade-offs
Separate OT directory (own forest or domain) with no trust to corporate	Large or multi-site manufacturers, safety-critical processes, high ransomware exposure	Strongest blast-radius containment; more accounts to manage and a joiner, mover and leaver process to duplicate
Separate OT directory with a one-way or selective trust	Organisations needing single sign-on for a few plant applications	Convenient, but a trust is a path; review it as a conduit under IEC 62443 zones and conduits
Plant systems joined to the corporate domain	Legacy state in many sites; small plants with few OT servers	Corporate compromise reaches the plant; plan to move away from it
Local accounts only, managed from a vault	Small sites, isolated cells, machines that cannot join a directory	Simple, but needs disciplined vaulting and rotation to avoid shared passwords

Small versus large manufacturers: a single-site manufacturer with a handful of OT servers can usually get most of the value from a vault, local accounts with unique passwords, one brokered remote access path and named vendor users. A multi-site group should build a central OT identity service per region or site with a common role model, so that an engineer's access at one plant is not automatically valid at all the others.

Regulatory and standards expectations

IEC 62443: Part 2-1 (2024 edition) covers the asset owner security programme, Part 2-4 the requirements on service providers, Part 3-2 risk assessment for system design using zones and conduits, Part 3-3 system security requirements and security levels, and Part 4-2 component requirements. Foundational requirement 1, identification and authentication control, includes SR 1.1 for human users, SR 1.2 for software processes and devices and SR 1.13 for access via untrusted networks. Security levels run from SL 1 (casual or accidental violation) to SL 4 (sophisticated, well-resourced and highly motivated attackers).
CISA CPG 2.0: released in December 2025, the CPGs now merge IT and OT goals into universal goals aligned with NIST CSF 2.0. The identity goals that matter most on the plant floor are 3.A, 3.C, 3.D, 3.F, 3.G and 3.H. See the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide.
NIS2: manufacturing of medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment appears among the "other critical sectors" in Annex II, so many manufacturers in the EU are important entities. Article 21 risk management measures include supply chain security, access control policies and multi-factor authentication. See the NIS2 Directive Guide.

Implementation roadmap

Discover (weeks 1 to 6): list every account on HMIs, engineering workstations, OT servers and machine panels; walk the cabinets for OEM modems and routers; export service accounts and their privileges; record every third party with any path into the plant.
Remove the worst exposures (weeks 4 to 12): change default passwords, disable dormant and departed users, cut OEM always-on connections over to the broker, and remove domain admin from service accounts. Test each change on one line during a planned stop.
Pilot named access (one line or cell): introduce badge or PIN re-authentication for change actions on one line, run it in parallel with the shared login for two to four weeks, collect operator feedback, then switch. Keep the old shared account disabled but recoverable for a defined period as the rollback.
Broker all remote access: one path, MFA, per-session approval and recording for vendors and remote engineers. Roll back by re-enabling a single controlled vendor path, never the old modems.
Govern non-human identities: owners, rotation and least privilege for MES, historian, OPC UA and IIoT credentials, scheduled around production calendars because rotation can stop a line if an interface is missed.
Scale and review: extend to remaining lines and sites, run quarterly access reviews (CPG 2.0 goal 3.H suggests quarterly reviews), and add identity checks to the commissioning checklist for every new machine.

Detection and measurement

Log authentication at jump hosts, the remote access broker, engineering workstations (Windows Security events 4624, 4625 and 4672 for logon, failure and special privileges) and HMI or SCADA audit trails, and send them to a collector in the industrial DMZ. Monitor for: vendor sessions outside an approved window, controller downloads or mode changes without a matching work order, service accounts logging on interactively, new local accounts on OT hosts, and repeated failed logins (CPG 2.0 goal 3.E).

Metric	Target direction
Share of HMI change actions attributable to a named user	Rising towards 100% on piloted lines
Number of OEM or vendor remote access paths outside the broker	Zero
Third-party accounts with no end date or no sponsor	Zero
OT service accounts with an owner and rotated within policy	Rising, reported per site
Controller downloads with a matching approved change	100%
Devices still on default credentials	Falling to zero, exceptions documented

Framework mapping

Plant control	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ATT&CK for ICS addressed
Named operator and engineer accounts	PR.AA-01, PR.AA-03	AC-2, IA-2	T0859 Valid Accounts
Brokered vendor and remote access	PR.AA-05, GV.SC-07	AC-17, MA-4	T0822 External Remote Services, T0886 Remote Services
Engineering workstation as privileged workstation	PR.AA-05	AC-6	T0843 Program Download, T0858 Change Operating Mode
Device identity and default credential removal	PR.AA-01	IA-3, IA-5	T0859 Valid Accounts
Removable media control and physical access	PR.AA-06	AC-3	T0847 Replication Through Removable Media
Monitoring of OT access	DE.CM-03	AU-6	T0836 Modify Parameter

CIS Controls v8.1 Controls 5 (Account Management), 6 (Access Control Management) and 15 (Service Provider Management), and ISO/IEC 27001:2022 Annex A controls 5.15 (access control), 5.18 (access rights), 5.19 (information security in supplier relationships) and 8.2 (privileged access rights) cover the same ground for the corporate side of the plant.

Common failure patterns

Accepting the machine as delivered: the new line goes live with the OEM's default panel passwords and its cellular router, because the factory acceptance test did not include identity.
Supplier credentials that never expire: integrator and supplier accounts survive the project. The Jira intrusion at Jaguar Land Rover in March 2025 used years-old third-party credentials that were still valid.
Plant joined to the office domain: a ransomware operator with corporate domain admin can reach every HMI and historian, turning an IT incident into lost production (T0828 Loss of Productivity and Revenue).
Service accounts with domain admin: an MES or historian account with domain-wide rights, used interactively by engineers because "it always works".
Rotating a credential without a dependency map: changing a historian or OPC UA account password during production and stopping data collection or a line.

Lessons from incidents

The Jaguar Land Rover Cyberattack 2025 shut down the company's network from 31 August 2025, paused production from 1 September and began a phased restart on 8 October 2025. JLR has not disclosed how the September attackers got in, and reports of phone-based impersonation were disputed by its then group CISO, so the specific identity failure is not confirmed. The confirmed lesson for manufacturers is about impact and third parties: an earlier intrusion that year used a supplier employee's long-lived credentials, and the Cyber Monitoring Centre estimated the UK cost of the shutdown at about £1.9 billion. See the OT Incident Response Guide.

Practitioner checklist

Inventory every account on HMIs, panels, engineering workstations and OT servers, including OEM-shipped accounts.
Change all default credentials before connection and store new values in a vault with check-out.
Find and remove OEM modems, routers and remote desktop tools; route all remote access through one broker with MFA, approval and recording.
Give every vendor and contractor a named, sponsored account with an end date.
Separate OT admin accounts from office accounts and treat engineering workstations as privileged access workstations.
Introduce badge or PIN re-authentication for change actions on HMIs, keeping a non-locking view role.
Assign owners to MES, historian, OPC UA, IIoT and ERP integration identities and rotate on a production-aware schedule.
Decide and document the IT and OT directory model, and review any trust as a conduit.
Add identity requirements to machine purchase specifications and factory and site acceptance tests.
Report the six metrics above per site each quarter.

Manufacturing Identity and OT Access Guide: Securing the Plant Floor