Zero trust access control for OT environments is closing compliance gaps

At a glance

What this is: NHI Mgmt Group's analysis, drawing on SSH Communications Security's blog post: OT compliance gaps persist because legacy remote access patterns still rely on broad trust instead of task-scoped identity control.

Why it matters: It matters because IAM, PAM, and identity governance teams need controls that support industrial access without losing traceability, least privilege, or auditability.

Context

Operational technology access is no longer confined to a closed plant network. As ICS, manufacturing systems, and critical infrastructure connect to corporate and cloud environments, the identity problem shifts from perimeter control to governed remote access across internal staff, vendors, and integrators.

The compliance gap is not that OT lacks access controls in theory. It is that VPN-based access, shared credentials, and incomplete session records make it difficult to prove who accessed what, when, and for how long, which is exactly where modern industrial governance frameworks expect traceability.

In practice, OT identity governance has to balance safety, uptime, and accountability at the same time. That makes zero trust access control, not broad network reach, the relevant operating model for critical-sector environments.

Key questions

Q: What breaks when OT access control relies on VPNs, firewalls, and shared passwords alone?

A: VPNs and firewalls can protect network entry points, but they do not provide user-level authorization, granular target control, or reliable auditability. In OT, that means multiple people can reach systems without clear accountability, shared credentials can circulate unchecked, and access often cannot be constrained to the task, asset, or time window actually required.

Q: Why do persistent credentials create so much OT compliance risk?

A: Persistent credentials blur the boundary between approved maintenance and residual access, which makes it hard to prove when authority started and ended. In OT, that weakens both security and auditability because the same credential can outlive the task it was issued for. Standing privilege is often the hidden failure mode behind failed access governance.

Q: What are the signs that OT access governance is not keeping up?

A: Look for overlapping VPN access paths, shared accounts across vendors and internal staff, incomplete session logs, and maintenance workflows that cannot show when access started or ended. Those are practical indicators that the organisation can connect systems, but cannot yet prove controlled access or defensible traceability.

Q: When should teams prioritise just-in-time access over session recording?

A: Prioritise just-in-time access when the risk comes from standing privilege, fast-moving cloud operations, or machine-speed workflows that cannot wait for later review. Recording can supplement governance, but it should not be the first line of defence when the goal is to prevent privileged misuse before the session begins.

Technical breakdown

Why VPN-based OT access creates governance debt

Traditional VPN access treats the network as the trust boundary, then leaves identity and authorisation too broad once a session starts. In OT environments, that model collides with shared accounts, vendor support workflows, and maintenance windows that often outlive the original need for access. The result is governance debt: access becomes hard to scope, hard to attribute, and hard to revoke cleanly. Centralised visibility also breaks down when multiple operators, external providers, and plant teams reuse the same pathway for different jobs. This is not just a security problem. It is a compliance problem because traceability and accountability are part of the control objective, not an afterthought.Practical implication: Replace network-based trust with identity-scoped remote access and per-session attribution.

Practical implication: Replace network-based trust with identity-scoped remote access and per-session attribution.

How JIT access changes OT privilege scope

Just-in-Time access changes OT governance by making privilege temporary, task-bound, and explicitly issued for a specific work window. Instead of permanent entitlements or standing vendor access, the user or service provider receives a short-lived credential that expires after the task ends. That matters in OT because remote troubleshooting, patching, and maintenance often need elevated access but only briefly. JIT does not remove the need for policy. It changes the control point from ongoing trust to issuance time, where scope, duration, and accountability can be enforced together. That is why JIT aligns better with controlled industrial operations than persistent access models do.Practical implication: Scope OT elevation to the task and revoke it automatically at task completion.

Practical implication: Scope OT elevation to the task and revoke it automatically at task completion.

Why session logging is a compliance control, not just monitoring

Session logging in OT is more than an investigation feature. It is the evidence layer that lets organisations prove who did what inside a sensitive industrial environment. When access is remote, especially across legacy protocols and third-party support workflows, a clean audit trail becomes the difference between defensible compliance and opaque exception handling. Recording the session also reduces ambiguity around vendor actions, maintenance changes, and privileged commands, because the activity can be reviewed against the access request that authorised it. Without that linkage, organisations may have logs but still lack traceability. In industrial governance terms, visibility has to be tied to authorisation, not just collection.Practical implication: Tie session recording to identity issuance so the audit trail proves authorised activity.

Threat narrative

Attacker objective: The objective is to reach OT systems through overly broad remote access and exploit the lack of traceable, time-bound control.

1. Entry occurs through legacy OT remote access, often via VPNs or shared credentials that were designed for convenience rather than traceability.
2. Privilege persists beyond the maintenance need because standing access and reused credentials remain active after the task should have ended.
3. Impact appears as weak auditability, expanded attack surface, and compliance gaps that make it difficult to prove controlled access to critical systems.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT compliance failures are identity failures before they are network failures. IEC 62443 and NIS2 both depend on knowing who can access industrial systems, under what conditions, and with what evidence. When organisations keep treating OT remote access as a connectivity problem, they miss the governance layer that regulators actually need. The practical conclusion is that OT access control has to be designed as identity governance, not as an IT networking extension.

Shared credentials create accountability debt in industrial environments. Once engineers, vendors, and integrators enter the same access path with reusable credentials, attribution collapses even if the system is technically reachable. That breaks the basic compliance assumption that activity can be tied back to a named actor and a specific task. The implication is that OT programmes need per-user, per-session accountability as a baseline rather than an exception.

JIT is the decisive control shift because it moves authority to issuance time. Persistent access assumes the right people can be trusted to hold access until review catches up; OT maintenance reality does not support that assumption. JIT access narrows the privilege window to the work itself, which is the only period regulators and auditors can meaningfully defend. The practical conclusion is that standing privilege should become the exception, not the default, in OT governance.

Full session visibility is becoming the evidence standard for critical-sector access. Industrial environments cannot rely on coarse logs when remote vendors and internal teams use the same systems for different operational tasks. Traceability has to show the authorised identity, the approved duration, and the recorded action trail. The practical conclusion is that recording without authorisation linkage is incomplete governance.

Zero trust for OT is not a slogan, it is a control boundary reset. The article points to a broader shift in how critical infrastructure access is being governed: from broad connectivity with after-the-fact review to least-privilege access with evidence built in. That shift aligns the operating model with modern compliance expectations and exposes where legacy access methods still hide risk. The practical conclusion is that OT programmes should be measured by whether access can be proven, not merely granted.

What this signals

Task-scoped access is becoming the practical baseline for industrial environments. OT programmes cannot rely on perimeter trust when remote vendors, engineers, and maintenance teams all need different levels of access at different times. The governance shift is toward issuing privilege for the task, then proving that the task stayed within its approved boundary.

Industrial access control now has to satisfy both operations and audit. The hard part is not allowing maintenance to happen, but doing so in a way that leaves enough evidence for compliance, incident review, and vendor accountability. That makes identity governance a reliability issue as much as a security issue.

For practitioners

• Adopt identity-scoped remote access Replace shared VPN entry points with per-user access that maps each session to a named identity, a defined task, and a clear expiry condition.
• Issue Just-in-Time privileges for maintenance work Grant elevated access only for the maintenance window or troubleshooting task, then expire it automatically when the authorised work ends.
• Record and retain OT sessions centrally Capture session activity, command history, and access metadata so auditors can reconcile who entered the system and what they changed.
• Remove shared credentials from vendor workflows Assign each external provider a distinct identity path and offboard access as soon as the support engagement ends.

Key takeaways

• OT access control is moving from broad network trust to per-session identity governance because legacy remote access models cannot prove who did what.
• Compliance pressure from frameworks such as IEC 62443 and NIS2 is exposing the weakness of shared credentials, persistent access, and incomplete audit trails.
• JIT access and session recording are the two controls that most directly turn OT access into something auditors and operators can both defend.

Key terms

• Zero Trust Access Management: Zero Trust access management is the practice of making every access decision explicit, contextual, and continuously reassessed. It replaces blanket trust in a network zone with identity, device, and risk-based policy that can change during a session. In mature programmes, it governs both human and non-human actors.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Session Recording: Session recording is the capture of user activity during a privileged session, such as commands, queries, or administrative actions. It gives security and audit teams a verifiable record of what happened after authentication, which is essential when access itself is not enough to prove control.
• Remote Access Governance: Remote access governance is the set of policies and controls that determine who can connect, under what conditions, and with what level of oversight. In practice, it covers authentication, session monitoring, approval workflows, logging, and the separation of employee, vendor, and privileged access paths.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.