Topic starter
24/10/2026 8:52 pm
TL;DR: Standing third-party access in data centres outlives the maintenance task and makes ownership harder to trace, according to Forescout. Remote access needs named identities, session oversight and fast shutdown so operators can reconstruct events and narrow who can reach operational systems.
Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “Secure Remote Access: The Data Center Risk Not on the Uptime Slide”.
Key questions
Q: Why do standing vendor accounts increase risk in operational environments?
A: Standing vendor accounts extend trust beyond the maintenance task that justified them.
Q: How should teams govern remote maintenance access for industrial devices?
A: Treat OEM maintenance as a controlled identity relationship, not a convenience channel.
Q: What breaks when third-party remote access is not tightly scoped?
A: When vendor access is not tied to a specific purpose and expiry, organisations lose control over who can reach sensitive systems, what they can touch, and how long the access remains valid.
Practitioner guidance
- Inventory every third-party remote pathway List vendors, integrators, MSPs and facilities teams that can still reach operational systems, then assign an owner, business justification and expiry date to each pathway.
- Replace shared vendor logins with named access Require named identities for each remote session and remove shared accounts such as generic vendor administrator logins that obscure accountability.
- Add session recording and live termination Monitor remote sessions in real time, retain recordings for investigation, and ensure operators can end a session the moment behaviour looks unsafe.
Bottom line: Remote access in critical infrastructure is now a reliability and accountability issue, not just a connectivity issue.
Glossary terms: Secure Remote Access, Standing Access, Session Oversight, Third-Party Access Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Remote access has become a reliability control, not a convenience feature. Once third parties can reach power, cooling, and building systems, the security question is inseparable from operational continuity. That means access approval, session visibility, and offboarding now sit alongside uptime and redundancy as core governance issues. The practitioner implication is that remote access must be managed as part of critical infrastructure control.
A question worth separating out:
Q: What should operators verify before allowing third-party access to critical systems?
A: Operators should verify the identity of the person, the exact system they need, the duration of access, and the evidence available if something goes wrong. If any of those elements are unclear, the access model is too broad for a reliability-sensitive environment and should be narrowed before use.
👉 Read our full editorial: Remote access governance is now a reliability issue for data centers
This post was modified 6 days ago by NHI Mgmt Group