TL;DR: Fernwartung ist in vernetzten Produktionsumgebungen unverzichtbar, but uncontrolled third-party access expands OT attack surface and complicates NIS2 compliance, according to Imprivata’s analysis of vendor access, session monitoring, and auditability. The governance lesson is that visibility and time-bound approval are now core control requirements, not optional add-ons.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Imprivata's blog post: Industrial remote maintenance is now a governance problem as much as a connectivity problem, because uncontrolled third-party access expands OT exposure and weakens auditability under NIS2.
Why it matters: For IAM, PAM and OT security teams, the practical issue is not whether remote access exists, but whether every vendor session is identity-bound, time-limited and observable enough to satisfy regulatory and operational controls.
Context
Remote maintenance in manufacturing is no longer an exception workflow. Connected machines, control systems, sensors and external service partners make third-party access part of the operating model, which means identity governance now has to cover OT session control as well as traditional user access.
The security gap is not remote access itself, but remote access that is not explicitly approved, time-bounded and centrally observed. In NIS2-covered environments, that creates a compliance problem because operators must be able to show who accessed production systems, when, and under what control conditions.
Key questions
Q: What breaks when session monitoring is missing from industrial remote access?
A: Without session monitoring, organisations lose the ability to see what a privileged user or vendor actually did inside the environment. In OT and ICS, that gap matters because the same access used for maintenance can also be used for unsafe command execution or lateral movement. Recording and intervention are what turn remote access into governable access.
Q: Why does remote vendor access create NIS2 compliance pressure in manufacturing?
A: Because NIS2 expects operators to manage cyber risk in a way they can demonstrate. If third-party access is not approved, time-limited and auditable, the organisation cannot easily show that it controlled supply-chain and access-risk exposure in a defensible way.
Q: How do security teams know whether vendor access is actually governed?
A: They should be able to answer three questions without delay: who has access, what they can reach, and how quickly access can be removed everywhere it exists. If the answers depend on spreadsheets, informal knowledge, or separate tool owners, governance is incomplete. A real control environment can prove scope and revocation end to end.
Q: What should teams do when external support needs privileged access to production systems?
A: Use a governed third-party access model that separates vendors from internal administrators, limits privilege to the task at hand and preserves a record of every action. That keeps support workable without turning remote maintenance into open-ended trust.
Technical breakdown
Why vendor access changes the OT identity model
Industrial remote access is different from standard IT remote access because the session can affect plant state, production continuity and equipment safety, not just data. External engineers often need elevated privileges across SPS, HMI and maintenance tooling, yet they sit outside the operator's normal employee governance processes. That creates a separate trust boundary where identity verification, scope restriction and session oversight have to be explicit. In practice, vendor access is a privileged identity problem inside an operational environment, not a generic connectivity issue.
Practical implication: treat vendor sessions as privileged OT identities and govern them separately from internal user access.
How just-in-time access and session control work together
Just-in-time access narrows exposure by granting privilege only when the task begins, while session control keeps that privilege tied to a specific, observable maintenance event. In OT, this matters because a long-lived remote channel can outlast the work it was opened for and remain usable if credentials are reused or a vendor relationship changes. Session recording, central approval and automatic termination are what make the access governable. Without those controls, remote maintenance becomes standing access with a different label.
Practical implication: issue vendor access only for the maintenance window and make session termination automatic when the task ends.
Why audit trails matter more in regulated manufacturing
Auditability is not a reporting extra in regulated production environments. It is the evidence layer that shows whether access was authorised, whether the operator retained control and whether the third party stayed within scope. Detailed logs and session recordings support incident response, forensics and compliance testing because they reconstruct who did what on which asset. NIS2's emphasis on risk management and supply-chain oversight makes that evidence operationally relevant, not just administratively useful.
Practical implication: retain session-level evidence that can prove access scope, approval and operator oversight during reviews or investigations.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Vendor access without lifecycle offboarding is the central governance weakness in industrial remote maintenance. The article shows that external privileged access often persists as an operational convenience long after the immediate task is complete. That is not just a control gap, it is a lifecycle problem: the organisation has allowed a third party to behave like a permanent insider. The practitioner implication is that vendor access must be governed as a time-bound identity with an end state, not as an open-ended support relationship.
OT remote maintenance turns NIS2 from a policy requirement into an identity control requirement. The article makes clear that the issue is not generic cybersecurity maturity, but whether access can be authorised, observed and evidenced in a way that stands up to regulatory scrutiny. In that sense, NIS2 is pushing manufacturing teams toward identity-bound access, session accountability and supply-chain governance as one control plane. Practitioners should expect auditability to become a procurement and operating requirement, not a post-incident retrofit.
Time-boxed access is now the minimum viable control for external production support. In industrial environments, the security question is no longer whether a vendor can reach the asset, but whether the operator can limit the reach to a single task and prove it afterwards. That shifts the security model away from broad remote connectivity and toward explicit approval, scoped entitlement and observable execution. The practitioner conclusion is straightforward: if a maintenance session cannot be bounded, it is not governed.
Remote access in manufacturing is becoming a third-party identity governance problem, not just a network design problem. The article connects external support, vendor privilege, auditing and NIS2 obligations into one operating issue. That means the relevant control discussions belong equally to IAM, PAM, OT security and compliance teams. The implication for practitioners is to assess vendor sessions as governed identities with lifecycle, scope and evidence requirements.
Observability is the named concept that now defines safe industrial remote access. In this context, observability means more than logs. It means the ability to reconstruct who approved the session, what the vendor touched, when access ended and whether the interaction stayed inside the authorised boundary. Without that evidence, NIS2-aligned remote maintenance remains asserted rather than demonstrable. Practitioners should treat observability as a control objective, not a reporting artifact.
What this signals
Remote maintenance is becoming a governance test, not just a technical convenience. As production systems become more connected, the weak point is the assumption that a trusted support relationship automatically justifies ongoing privileged access. Manufacturers need to design for session-level control and evidence from the start, because post-hoc visibility is too late to prove discipline.
Identity-bound access is the control pattern OT teams now need to standardise. The important shift is from network reachability to accountable execution. Once vendors are treated as privileged identities with approvals, expiry and recording, the same model can support audits, incident reviews and operational continuity without broadening standing access.
For practitioners
- Define a vendor access lifecycle Treat external maintenance access as a governed lifecycle with request, approval, use, expiry and offboarding stages. This avoids leaving vendor credentials or sessions active after the maintenance purpose has ended.
- Enforce session-bound approvals Require explicit approval before each remote maintenance session and bind that approval to a specific asset, task and time window. The operator should control when the session begins and when it stops.
- Record and review OT sessions Enable session recording, audit logs and user attribution for every privileged third-party interaction. Use that evidence for incident response, compliance checks and post-maintenance verification.
- Separate internal and external privileged access Do not let service partners share the same access paths or privilege model as employees. Use distinct entitlement rules, monitoring and review cycles for external vendors.
- Map remote maintenance to NIS2 controls Document how remote access, supply-chain oversight and authentication controls satisfy your NIS2 risk management obligations. Keep the mapping current when vendors, assets or maintenance processes change.
Key takeaways
- Industrial remote access creates risk when it is treated as a permanent convenience instead of a governed identity event.
- The article ties NIS2, OT auditability and vendor access into one operational problem: proving control over who touched production systems and when.
- The strongest preventive control is session-bound third-party access with explicit approval, limited duration and complete evidence of activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, NIST Zero Trust (SP 800-207) sets the technical controls, and DORA and NIS2 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | External vendor access persisting beyond the maintenance task is the core control issue here. |
| NHI-05 — Overprivileged NHI | Vendor sessions often need more privilege than internal teams realise, which raises OT blast radius. | |
| Recommendation — Define expiry and offboarding for every third-party maintenance session. Constrain vendor entitlements to the smallest task-scoped privilege set possible. | ||
| NIST Zero Trust (SP 800-207) | Principle of least privilege — Least privilege | The article's Zero Trust framing depends on limiting implicit trust in external support connections. |
| Recommendation — Apply zero trust principles to every vendor session instead of trusting the remote channel by default. | ||
| DORA | ICT third-party risk management | The article's third-party access theme maps to the broader regulated-supplier oversight problem DORA addresses. |
| Recommendation — Use third-party risk governance to keep supplier access bounded, monitored and contractually accountable. | ||
| NIS2 | Art.21 — Cybersecurity risk-management measures | The article is explicitly about the controls NIS2 expects for regulated industrial remote access. |
| Recommendation — Document remote-access controls as part of your NIS2 risk-management measures and keep evidence current. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Uncontrolled vendor credentials can become a path to broader access and movement inside OT environments. |
| Recommendation — Map remote maintenance abuse paths to credential access and lateral movement techniques in your detections. | ||
Key terms
- Vendor Privileged Access Management: Vendor Privileged Access Management is the control of privileged access granted to external suppliers, contractors, and service providers. It governs how third parties receive, use, monitor, and revoke elevated access to systems and data. In practice, it combines identity verification, least privilege, session oversight, approval workflows, and periodic access review.
- Just-in-time tool access: Just-in-time tool access means granting a testing agent only the permissions it needs for a specific task and only for the time required. In offensive AI workflows, this limits the blast radius if the system behaves unexpectedly or reaches beyond its intended scope.
- Session Recording: Session recording is the capture of user activity during a privileged session, such as commands, queries, or administrative actions. It gives security and audit teams a verifiable record of what happened after authentication, which is essential when access itself is not enough to prove control.
- Zero Trust Access Management: Zero Trust access management is the practice of making every access decision explicit, contextual, and continuously reassessed. It replaces blanket trust in a network zone with identity, device, and risk-based policy that can change during a session. In mature programmes, it governs both human and non-human actors.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 6, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org