Remote access governance is now a reliability issue for data centers

At a glance

What this is: This analysis argues that data centre remote access has become a governance and reliability problem because too many third parties still retain standing access to operational systems.

Why it matters: It matters to IAM, PAM and NHI practitioners because the same remote pathways used by vendors and integrators can outlive approval, obscure accountability and create operational risk without session-level control.

Context

Remote access in data centres is no longer just a connectivity layer. Once a facility’s operational technology and building systems are critical to reliability, the question becomes who can reach them, how that access is approved, and whether the activity can be reconstructed after the fact.

The governance gap is familiar across industrial and enterprise environments: third parties often keep access long after the original deployment or maintenance task has ended, and the organisation may know the account exists without knowing what it can still do. That creates an identity and accountability problem as much as a cyber one, especially where remote sessions control power, cooling, or building systems.

Key questions

Q: What breaks when third-party remote access is not tightly scoped?

A: When vendor access is not tied to a specific purpose and expiry, organisations lose control over who can reach sensitive systems, what they can touch, and how long the access remains valid. That creates excess privilege, weak traceability, and a larger breach surface if the vendor or one of its suppliers is compromised.

Q: Why do standing vendor accounts increase risk in operational environments?

A: Standing vendor accounts extend trust beyond the maintenance task that justified them. The longer they remain active, the more likely they are to be reused, forgotten, or abused, and the harder it becomes to tie each connection to a named person and a current business need. That is a lifecycle failure, not just an access issue.

Q: How should teams govern remote maintenance access for industrial devices?

A: Treat OEM maintenance as a controlled identity relationship, not a convenience channel. Access should be tied to named device identities, limited to approved support windows or workflows, and designed so that the operator can revoke trust when the relationship changes.

Q: What should operators verify before allowing third-party access to critical systems?

A: Operators should verify the identity of the person, the exact system they need, the duration of access, and the evidence available if something goes wrong. If any of those elements are unclear, the access model is too broad for a reliability-sensitive environment and should be narrowed before use.

Technical breakdown

Why VPN connectivity is not remote access governance

A VPN creates a network path, not an identity control plane. It can prove that a device or user reached the environment, but it does not by itself enforce named ownership, task scope, session monitoring, or immediate revocation when the job is done. In operational environments, that distinction matters because the remote user is often an OEM, contractor, or integrator rather than a permanent employee. Without a control layer above transport, the organisation cannot tell whether access is still justified or whether the session drifted beyond the approved maintenance window. See the Remote Access Identity Guide.

Practical implication: Treat VPN access as transport only and add identity, approval and session controls on top.

Why standing third-party access becomes a reliability risk

Standing access turns a maintenance convenience into a governance liability. If a vendor account, shared login, or forgotten remote pathway remains active, the organisation has no clean lifecycle boundary for who may touch building management, power monitoring, or cooling controls. That creates both operational exposure and audit friction because ownership is diffuse and offboarding is often informal. The risk is not only malicious misuse. It is also accidental change, stale privilege, and the inability to prove who was connected when a fault occurred. See the Third-Party Risk Management Guide.

Practical implication: Inventory all third-party pathways and bind each one to an accountable owner, approval path and expiry date.

Why session visibility matters more than after-the-fact logs

Remote access governance fails when teams can describe who had access but not what happened inside the session. Recording, live monitoring, and the ability to terminate a session are what convert remote access from blind trust into operational control. This is especially important in cyber-physical environments where a session can change configuration, disable safeguards, or alter availability in minutes. Logs alone are often insufficient because they show that a connection existed, not whether the operator stayed inside the authorised task. See the Privileged Session Management Guide.

Practical implication: Use privileged session controls that support live oversight, recording and immediate interruption of suspicious activity.

Threat narrative

Attacker objective: The objective is to reach and influence operational systems through a trusted remote pathway while avoiding strong session oversight.

1. Entry occurs through a remote access path held by a vendor, contractor or integrator rather than through direct physical presence.
2. Credential or session abuse follows when that access is standing, shared, or weakly governed, allowing connection to operational systems beyond the original task.
3. Impact appears as loss of accountability, unsafe configuration change, or inability to reconstruct what happened inside critical building or power systems.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Remote access has become a reliability control, not a convenience feature. Once third parties can reach power, cooling, and building systems, the security question is inseparable from operational continuity. That means access approval, session visibility, and offboarding now sit alongside uptime and redundancy as core governance issues. The practitioner implication is that remote access must be managed as part of critical infrastructure control.

The trust gap in data centre remote access is really an identity problem. Organisations often know that vendors connect, but not which named person is responsible for each session, what role they used, or whether the account still belongs in the environment. That is exactly the sort of lifecycle ambiguity remote access identity controls are meant to close. The practitioner implication is to replace ambient vendor access with explicit identity binding and expiry.

Standing vendor pathways are the named governance failure. The article’s core failure mode is not the existence of remote access itself but the persistence of access after the original need has faded. That is a classic offboarding and accountability problem, and it becomes more serious when operational systems are involved. The practitioner implication is to treat every remote pathway as temporary unless lifecycle ownership proves otherwise.

Purpose-built secure remote access is an operating model change, not a tool swap. The distinction is whether the organisation can approve, observe, and terminate access at session level instead of merely handing out network reachability. In critical environments, that shift aligns remote access with zero trust principles and with the governance expectations that utilities have already faced. The practitioner implication is to judge controls by evidence of oversight, not by connection success alone.

Read next: Privileged Session Management Guide

What this signals

Remote access governance is converging with resilience planning. Data centre operators are being pushed to prove not just that systems stay online, but that third-party access can be approved, observed and withdrawn in a controlled way. That shifts remote access from a convenience layer into part of the reliability control set, especially where cyber-physical systems can alter uptime within minutes.

Standing vendor access is becoming a visible governance debt. The longer an environment relies on dormant accounts, shared logins and informal approvals, the harder it becomes to answer basic accountability questions under regulatory or incident pressure. The programme implication is straightforward: remote access inventories, expiry enforcement and session oversight need to be treated as operational controls, not optional hardening.

For practitioners

• Inventory every third-party remote pathway List vendors, integrators, MSPs and facilities teams that can still reach operational systems, then assign an owner, business justification and expiry date to each pathway. See the Third-Party Risk Management Guide.
• Replace shared vendor logins with named access Require named identities for each remote session and remove shared accounts such as generic vendor administrator logins that obscure accountability.
• Add session recording and live termination Monitor remote sessions in real time, retain recordings for investigation, and ensure operators can end a session the moment behaviour looks unsafe. See the Privileged Session Management Guide.
• Validate remote access against operational scope Limit each connection to the specific system, protocol and task required, rather than allowing broad reach into the wider operational network.
• Review dormant remote access before regulatory deadlines Use the new reliability scrutiny around large computational loads as a trigger to find long-lived accounts, forgotten vendor access and weak approval workflows.

Key takeaways

• Remote access in critical infrastructure is now a reliability and accountability issue, not just a connectivity issue.
• The main failure mode is standing third-party access that outlives the task, obscures ownership and weakens incident reconstruction.
• Named identities, session oversight and rapid termination are the controls that turn remote access into governed operational access.

Related NHI Mgmt Group resources: Remote Access Identity Guide · Third-Party Risk Management Guide · Privileged Session Management Guide · Conditional Access Guide

Key terms

• Secure Remote Access: Secure remote access is the controlled method of reaching systems from outside their normal operating boundary. In industrial environments it must combine identity verification, session governance, and protocol constraints so that support access does not become unrestricted operational control.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
• Session Oversight: Session oversight is the ability to observe, record, and if necessary interrupt an active access session. It matters when remote users can alter critical systems because logs alone often show only that a connection existed, while oversight shows what happened inside the session itself.
• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and identity practitioners connect lifecycle control to the broader programmes they run.