Topic starter
06/06/2026 11:14 am
TL;DR: OT environments are increasingly connected to corporate networks and remote providers, but VPN sprawl, persistent credentials, weak visibility, and incomplete audit trails still make compliance with IEC 62443 and NIS2 difficult, according to SSH Communications Security. Granular, task-based access with JIT and session logging shifts OT identity governance from broad trust to verifiable, least-privilege control.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “OT Compliance Starts with Secure Access”.
Key questions
Q: What breaks when OT access control relies on VPNs, firewalls, and shared passwords alone?
A: VPNs and firewalls can protect network entry points, but they do not provide user-level authorization, granular target control, or reliable auditability.
Q: Why do persistent credentials create so much OT compliance risk?
A: Persistent credentials blur the boundary between approved maintenance and residual access, which makes it hard to prove when authority started and ended.
Q: What are the signs that OT access governance is not keeping up?
A: Look for overlapping VPN access paths, shared accounts across vendors and internal staff, incomplete session logs, and maintenance workflows that cannot show when access started or ended.
Practitioner guidance
- Adopt identity-scoped remote access Replace shared VPN entry points with per-user access that maps each session to a named identity, a defined task, and a clear expiry condition.
- Issue Just-in-Time privileges for maintenance work Grant elevated access only for the maintenance window or troubleshooting task, then expire it automatically when the authorised work ends.
- Record and retain OT sessions centrally Capture session activity, command history, and access metadata so auditors can reconcile who entered the system and what they changed.
Bottom line: OT access control is moving from broad network trust to per-session identity governance because legacy remote access models cannot prove who did what.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:55 am
OT compliance failures are identity failures before they are network failures. IEC 62443 and NIS2 both depend on knowing who can access industrial systems, under what conditions, and with what evidence. When organisations keep treating OT remote access as a connectivity problem, they miss the governance layer that regulators actually need. The practical conclusion is that OT access control has to be designed as identity governance, not as an IT networking extension.
A question worth separating out:
Q: When should teams prioritise just-in-time access over session recording?
A: Prioritise just-in-time access when the risk comes from standing privilege, fast-moving cloud operations, or machine-speed workflows that cannot wait for later review. Recording can supplement governance, but it should not be the first line of defence when the goal is to prevent privileged misuse before the session begins.
👉 Read our full editorial: Zero trust access control for OT environments is closing compliance gaps