How should manufacturers govern access in a digital factory?

Manufacturers should govern digital factory access as a shared identity problem across people, systems, machines, and facilities. That means mapping every privileged path, removing shared credentials where possible, and tying access approval, review, and revocation to operational roles and shift changes. The goal is attributable access that supports uptime without creating hidden lateral movement paths.

Why This Matters for Security Teams

Digital factory access is not just badge control or IT account management. It spans operators, contractors, PLCs, HMIs, SCADA, service accounts, machine identities, and maintenance tooling, all of which can create privileged paths into production. Security teams often underestimate how quickly a convenience account becomes a lateral movement route when it is shared across shifts, vendors, or automation jobs. The NIST Cybersecurity Framework 2.0 emphasizes governance and access control, but manufacturers must translate that into plant-floor realities.

NHI Management Group’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges and only 5.7% of organisations have full visibility into their service accounts. That matters in manufacturing because hidden access is often distributed across MES integrations, remote support tools, and vendor-maintained systems. In practice, many security teams encounter credential sprawl only after an outage, a plant audit, or a maintenance-related compromise has already exposed the gap.

How It Works in Practice

Access governance in a digital factory works best when it is treated as a lifecycle problem, not a one-time provisioning task. Start by inventorying all privileged paths: human users, service accounts, machine-to-machine credentials, engineering workstations, vendor remote access, and facility systems. Then map each path to an operational purpose, an owner, and a revocation trigger. The OWASP Non-Human Identity Top 10 is useful here because factory automation commonly depends on secrets and service identities that outlive the job they were created for.

Current guidance suggests combining least privilege with short-lived access where possible. For example:

• Use role-based access for stable human duties such as shift lead, maintenance engineer, or controls engineer.
• Use just-in-time elevation for break-glass and maintenance actions that do not need standing privilege.
• Prefer workload identity and machine certificates for equipment-to-platform communication instead of embedded shared secrets.
• Rotate credentials on a schedule tied to operational risk, not convenience.
• Revoke access automatically when a contractor assignment, shift, or service window ends.

For NHI and service access, the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is especially relevant because industrial environments often have long-lived integrator accounts and device secrets that are hard to trace. The practical goal is attributable access: every action should resolve to a person, system, or service with an owner, a scope, and an expiry. These controls tend to break down when plants rely on shared vendor passwords, offline equipment, or unmanaged legacy systems that cannot support centralized identity controls.

Common Variations and Edge Cases

Tighter access controls often increase operational friction, so manufacturers have to balance safety, uptime, and auditability rather than chase perfect lock-down. That tradeoff is especially visible in 24/7 plants, where a failed approval workflow can delay a repair and create production loss. Best practice is evolving, and there is no universal standard for every OT environment, especially where legacy PLCs, air-gapped zones, or vendor-mandated service channels limit modern IAM features.

One common exception is emergency maintenance. Break-glass access may be justified, but it should be narrowly scoped, time-bound, and heavily logged, with after-the-fact review. Another edge case is third-party support: the same vendor may need access to multiple plants, but that does not justify a shared credential across sites. NHI Management Group’s Top 10 NHI Issues highlights how shared secrets and poor visibility become systemic risks, while the common factory pattern is to keep them alive because replacement feels disruptive. The right answer is to design access around process windows, not around permanent trust.

Related resources from NHI Mgmt Group

• How should security teams govern non-human identities that have persistent access?
• How should security teams govern API keys used for generative AI access?
• How should security teams govern human and non-human access in one programme?
• Who is accountable when access governance gaps appear during digital transformation?