Topic starter
12/06/2026 9:21 pm
TL;DR: Manufacturers are expanding third-party access across IT and OT, but fragmented onboarding, manual reviews, and delayed offboarding are making vendor risk harder to quantify, according to Imprivata and IDC InfoBrief data. The core problem is not access volume alone, but the absence of continuous identity governance for external users.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Third-party access in manufacturing: Managing vendors and associated risk”.
By the numbers:
- 80% of manufacturers report increased demand for identity and access management solutions.
- 32% struggle with managing contractors and third-party access.
Key questions
Q: What breaks when vendor access reviews are handled manually at scale?
A: Manual reviews break when the organisation has too many vendors, too much access churn, or too many systems to reconcile consistently.
A: Fourth parties sit outside direct contracts and oversight, yet they can still handle sensitive production data, infrastructure, and services that affect your business.
Q: How do security teams know whether vendor access is actually governed?
A: They should be able to answer three questions without delay: who has access, what they can reach, and how quickly access can be removed everywhere it exists.
Practitioner guidance
- Implement continuous vendor access reviews Replace calendar-based certification with event-driven review triggers tied to vendor role changes, project completion, and plant access changes so permissions do not outlive the business need.
- Centralise third-party identity records Maintain a single authoritative vendor database that links each contractor to approved systems, purposes, sponsors, and expiry conditions, so access can be traced and revoked consistently.
- Automate offboarding for external users Trigger deprovisioning when contracts end, work orders close, or maintenance windows expire, and verify removal across remote access, privileged sessions, and shared endpoints.
Bottom line: Manufacturing third-party access is expanding faster than manual governance can keep up, which leaves external users active without reliable visibility or timely removal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 11:21 pm
Third-party access in manufacturing is now a lifecycle governance problem, not a perimeter problem. The article shows that vendors are embedded in normal production operations, which means the identity model must follow the actual work, not the old assumption that external access is rare and easy to review. Manual processes break first when access becomes continuous and distributed. Practitioners should reframe third-party access as an identity lifecycle discipline with operational accountability.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should manufacturers govern third-party access in converged IT/OT environments?
A: Treat vendor access as task-scoped access, not a standing support pathway. Limit it to the specific system, short duration and approved session needed for the job, then monitor activity and remove access when the task ends. This reduces the chance that remote support becomes an uncontrolled route into production.
👉 Read our full editorial: Third-party access in manufacturing is exposing identity control gaps
This post was modified 6 days ago by NHI Mgmt Group