Critical Infrastructure Identity Security Guide

Attacks on essential services keep starting the same way: a valid account, a remote access path without strong authentication, or a supplier credential nobody revoked. Operators of energy, water, transport, health, telecoms and digital infrastructure run identity across corporate IT, operational technology (OT) and a dense web of suppliers, under several overlapping regulatory regimes. This guide takes a sector view: how identity risk differs in critical infrastructure, what regulators and standards now expect (NIS2, the UK NIS regime and the Cyber Security and Resilience Bill, the NCSC Cyber Assessment Framework, CISA's Cross-Sector Cybersecurity Performance Goals and IEC 62443), which controls to prioritise and how to show they work. It is written for security leads, OT and network engineers and compliance owners at operators and their critical suppliers. Generic OT identity design is covered in the Identity for OT Environments Guide.

Key takeaways

Valid accounts are the main way in. Colonial Pipeline was entered through a legacy VPN account without MFA, and Cisco Talos found that Salt Typhoon's telecom intrusions began with legitimate credentials in all but one investigated case.
Regulators now name identity controls explicitly. NIS2 Article 21 lists access control and multi-factor authentication, CISA CPG 2.0 has dedicated goals for MFA, unique credentials and separate admin accounts, and the NCSC CAF has a principle for identity and access control.
Infrastructure devices are identities too. Routers, firewalls, RTUs, PLCs and authentication servers hold shared secrets and local accounts; attackers who steal device configurations steal those identities.
Suppliers and managed service providers sit inside the trust boundary. Treat their access as a regulated conduit: named users, brokered sessions, contractual reporting and offboarding.
Identity must keep working when the network is isolated. Plan local authentication, break-glass accounts and recovery so that cutting a connection during an incident does not lock out the people running the service.

What makes identity in critical infrastructure different

Consequence: the impact is loss of availability, control or safety of a physical service, captured in MITRE ATT&CK for ICS as T0826 Loss of Availability and T0827 Loss of Control. Availability usually outranks confidentiality when choosing controls.
Adversaries: state-sponsored groups seek long-term, quiet access to pre-position in networks, which favours living off valid accounts over malware. See the Volt Typhoon Threat Actor Profile and the Threat Actor Groups Guide.
Estate shape: a large corporate IT estate, control centres, many remote sites (substations, pumping stations, telecom exchanges, signalling) and field devices with long service lives and limited authentication features.
Supplier dependence: OEMs, integrators, managed service providers and maintenance contractors often hold standing remote access to many operators at once.
Regulatory overlap: one operator may answer to a sector regulator, a national cyber authority, a safety regulator and, for multinationals, rules in several jurisdictions.
Isolation as a response: operators may deliberately disconnect OT from IT during an incident. Colonial Pipeline shut its pipeline down proactively on 7 May 2021 even though the ransomware hit business systems.

Identity attack patterns seen in essential services

Pattern	ATT&CK technique	Sector example	Primary identity control
Remote access with a stolen or reused password and no MFA	T1133 External Remote Services, T0822 External Remote Services (ICS)	Colonial Pipeline legacy VPN account, 2021	Phishing-resistant MFA on every remote path; disable dormant accounts
Living off legitimate accounts for persistence and movement	T1078 Valid Accounts, T0859 Valid Accounts (ICS)	Salt Typhoon telecom intrusions	Separate admin accounts, monitoring of account behaviour, short-lived privilege
Theft of device configurations to recover SNMP strings, local accounts and AAA shared secrets	T1078 Valid Accounts	Salt Typhoon captured SNMP, TACACS and RADIUS secrets	Strong device credential types, secret rotation, configuration integrity monitoring
Internet-exposed control devices with default or weak credentials	T0883 Internet Accessible Device	General pattern	Remove exposure, change defaults (CPG 2.0 goal 3.A)
Password spraying and brute force of remote services	T1110 Brute Force	General pattern	MFA, lockout tuned for OT, failed login alerts (CPG 2.0 goal 3.E)
Movement from IT to OT through shared directories and remote services	T0886 Remote Services (ICS)	General pattern	Separate OT identity domain, brokered jump hosts

The Salt Typhoon Telecom Intrusions 2025 page shows how network device identities become the attack surface: once in, the group changed AAA and TACACS+ server addresses, created local accounts and added SSH keys.

What regulators and standards expect

Regime	Status	Identity-relevant expectations
EU NIS2 Directive (2022/2555)	In force since 16 January 2023; applied through national transposition	Article 21 measures include supply chain security, human resources security, access control policies and asset management, and multi-factor or continuous authentication. Early warning of significant incidents within 24 hours, notification within 72 hours, final report within one month
UK NIS Regulations 2018 and NCSC CAF	In force; CAF version 4.0 (April 2024)	CAF objective B, principle B2 Identity and Access Control; used by regulators to assess operators of essential services
UK Cyber Security and Resilience (Network and Information Systems) Bill	Before Parliament: at Lords Report stage in October 2026, not yet law	Amends the NIS Regulations 2018 for systems used in essential activities; scope and duties may change before Royal Assent
CISA Cross-Sector CPGs 2.0	Voluntary; version 2.0 released December 2025	Goals 3.A to 3.H: default passwords, password strength (16 characters minimum where feasible), unique credentials across IT and OT, revoking leavers and vendors, failed login monitoring, MFA, separate privileged accounts, least privilege; 1.E managed service provider risk
ISA/IEC 62443	International standard series	FR 1 identification and authentication control: SR 1.1 human users, SR 1.2 software processes and devices, SR 1.13 access via untrusted networks; Part 2-4 for service providers
NIST SP 800-82 Rev. 3	Guidance, September 2023	OT security guidance and countermeasures, applying SP 800-53 controls to OT

CPG 2.0 merged the earlier separate OT goals into universal goals aligned with NIST CSF 2.0, and its MFA goal 3.F specifically names vendor, maintenance, remote engineering and HMI access in OT, with the fallback of removing remote access or segmenting where MFA is not possible. See the NIS2 Directive Guide, the UK Cyber Security and Resilience Bill Guide, the NCSC Cyber Assessment Framework (CAF) Guide and the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide.

Control priorities for essential services

1. Remote access

Single brokered path: all remote access to control centres and sites goes through a broker in a DMZ, with phishing-resistant MFA, per-session approval and recording. Inventory and remove direct VPNs, cellular modems and remote desktop tools installed by suppliers. See the OT Remote Access Guide.
Dormant account sweep: legacy VPN, test and project accounts are disabled automatically after a set period of inactivity, as CPG 2.0 goal 3.D describes.

2. Privileged and administrative access

Separate accounts and workstations: administrators of OT servers, control systems and network devices use dedicated accounts from privileged access workstations, never their email account (CPG 2.0 goal 3.G).
Just-in-time elevation: where the platform allows, grant admin rights for a work order and remove them afterwards. See the JIT Access Guide.

3. Network and infrastructure device identity

Central AAA with local fallback: authenticate device administrators through TACACS+ or RADIUS backed by named accounts and MFA, keep one vaulted local account per device for outages, and alert on any change to AAA server configuration.
Protect device secrets: use strong local password storage types, SNMPv3 rather than community strings, rotate shared secrets, and treat configuration backups as credential stores.

4. Suppliers and managed service providers

Contracted identity terms: named users, MFA, offboarding, incident and vulnerability reporting within a set time (CPG 2.0 goal 1.D), and agreed notification from managed service providers (goal 1.E).
Per-operator separation: a supplier serving many operators must not reuse one credential or jump host across customers. See the Third-Party Access Guide.

5. Non-human identities

Inventory and own them: SCADA and historian service accounts, data diodes and replication accounts, OPC UA and DNP3 Secure Authentication keys, certificates on RTUs and IIoT gateways, and API keys for market, grid or billing integrations. Each needs an owner, a rotation plan and least privilege. CPG 2.0 goal 3.C asks for each non-person account to have its own password. See the Service Account Security Guide.

Isolation, resilience and break-glass

Critical infrastructure operators must assume they will isolate OT from IT, or a site from the control centre, during an incident. Identity design decides whether that works.

No hard dependency on corporate identity: OT systems should authenticate against an OT identity service or local accounts, not a corporate directory or cloud identity provider that will be cut off or compromised.
Break-glass accounts: vaulted, offline-retrievable credentials per site and per critical system, tested at least annually and monitored for any use. See the Break-Glass Account Guide.
Offline MFA options: hardware tokens or smart cards that verify locally keep MFA in place when a cloud service is unreachable.
Recovery order: rebuild identity services first in recovery plans, from known-good backups, and reset privileged and service credentials before reconnecting. Colonial's chief executive testified that seven financial systems were still down more than a month after the attack, which shows how long recovery of business systems can take.

See the OT Incident Response Guide.

Decision guidance: scale and sector

Situation	Recommended approach	Trade-off
Small utility or municipal operator with few staff	Start with the CPG 2.0 identity goals: change defaults, MFA on remote access, unique credentials, offboarding. Use a vault and one brokered remote access service, possibly shared through a sector body or managed provider	Reliance on a provider makes that provider a critical supplier to manage
Large multi-site operator	Separate OT identity domain per region or business, central PAM, AAA for network devices, formal supplier access programme, regular red teaming of identity paths	Higher cost and duplicated joiner, mover and leaver processes
Field devices that cannot authenticate users	Compensating controls at the zone boundary: authenticated jump host, protocol allow-listing, physical security (IEC 62443 zones and conduits)	Accountability stops at the jump host
Operator in scope of NIS2 and UK NIS	One control set mapped to both regimes, evidence collected once	Requires a maintained mapping as both regimes change
Telecoms and digital infrastructure	Emphasise network device identity, AAA integrity and configuration secret protection	Large device estates make rotation operationally heavy

Sector-specific detail is in the Energy Sector Identity and OT Access Guide, the Water and Wastewater Cybersecurity Guide and the Manufacturing Identity and OT Access Guide.

Implementation roadmap

Map the essential service: identify the systems that deliver it, every identity (human, device, service, supplier) that can change them, and the regulations that apply.
Close the internet-facing gaps first: MFA on every remote access service, removal of exposed control devices, default credential changes, dormant account disablement. Test MFA on a pilot group and keep a vaulted emergency path as rollback.
Separate privilege: dedicated admin accounts and workstations, removal of shared admin passwords, AAA for network devices with vaulted local fallback.
Bring suppliers under control: inventory supplier paths, move them to the broker, add contract terms, set end dates. Run old and new paths in parallel for a short window, then close the old ones.
Govern non-human identities: owners, rotation schedules aligned to maintenance windows, and dependency maps so rotation cannot stop the service.
Prove resilience: exercise an IT to OT isolation and a site islanding scenario, confirming operators can still authenticate and break-glass works.
Report: map evidence to NIS2 Article 21, CAF B2 and CPG 2.0 goals, and review quarterly.

Detection and measurement

Collect authentication logs from remote access brokers, VPNs, jump hosts, AAA servers, domain controllers and OT servers into monitoring that survives an IT outage. Priority detections: logons by dormant or supplier accounts outside approved windows; impossible travel or new source networks on remote access; changes to AAA server settings, new local accounts or new SSH keys on network devices; service accounts logging on interactively; and any use of break-glass accounts.

Metric	Why it matters
Remote access paths into OT with phishing-resistant MFA (%)	Directly addresses the Colonial pattern; target 100%
Accounts inactive for more than 90 days still enabled	Dormant accounts are a recurring entry point; target zero
Supplier accounts that are named, sponsored and time-bound (%)	Measures third-party control
Network devices authenticating administrators through central AAA (%)	Reduces shared local passwords
Non-human identities with an owner and rotated within policy (%)	Shows NHI governance
Break-glass tests passed in the last 12 months	Proves identity works in isolation

Framework mapping

Control	NIST CSF 2.0	NIST SP 800-53 Rev. 5	CPG 2.0
Identity inventory including devices and services	PR.AA-01	AC-2, IA-3	3.C
MFA on remote and privileged access	PR.AA-03	IA-2, AC-17	3.F
Least privilege and separate admin accounts	PR.AA-05	AC-6	3.G, 3.H
Authenticator management and default credentials	PR.AA-01	IA-5	3.A, 3.B
Supplier and maintenance access	GV.SC-07	MA-4, SA-9	1.D, 1.E, 3.D
Segmentation of identity domains	PR.IR-01	AC-3	3.I
Monitoring of account activity	DE.CM-03	AU-6	3.E

CIS Controls v8.1 Controls 5, 6 and 15 and ISO/IEC 27001:2022 Annex A controls 5.15, 5.18, 5.19 and 8.5 (secure authentication) cover the same controls for the corporate estate.

Common failure patterns

Forgotten remote access accounts: a VPN account no longer in use but never disabled, protected by a password alone, as in the Colonial Pipeline Ransomware Attack 2021.
Treating network devices as plumbing: weak local password types and SNMP community strings in configurations that attackers can steal and crack offline, as Talos described for Salt Typhoon.
OT that depends on corporate identity: control systems that cannot be operated once the corporate directory is isolated or rebuilt.
Compliance by document: an access control policy written for NIS2 or CAF while shared operator and vendor accounts remain in daily use.
Supplier sprawl: dozens of supplier remote access methods, each approved once and never reviewed.
Untested break-glass: emergency credentials that are expired, unknown to the shift or stored on the system that has failed.

Lessons from incidents

At Colonial Pipeline, attackers used a legacy VPN account that had not been disabled and did not require MFA; Mandiant reported that its password appeared in a batch of leaked passwords. Access began as early as 29 April 2021, the pipeline was shut down on 7 May and was offline for about six days. The lesson for essential services is that a single unmanaged identity on a remote access path can halt a national service, even when the control systems themselves are not touched. The Salt Typhoon intrusions show the long-dwell version of the same problem: legitimate credentials, then theft of the secrets held by network devices and authentication servers, with access lasting more than three years in one case.

Practitioner checklist

Map every human, device, service and supplier identity that can change the essential service.
Enforce phishing-resistant MFA on all remote access, and remove remote access where MFA is impossible.
Disable dormant, legacy and departed accounts automatically, including supplier accounts.
Separate administrator accounts and workstations, and vault all shared and local admin passwords.
Put network devices behind central AAA, protect configuration secrets and alert on AAA changes.
Route supplier and managed service provider access through one broker with named users and contract terms.
Assign owners and rotation schedules to all non-human identities in OT.
Design OT identity to survive isolation from corporate IT, and test break-glass accounts.
Map evidence once to NIS2 Article 21, CAF B2 and CPG 2.0, and track the UK Bill as it completes Parliament.

Standards and references

Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · OT Security Guide · NIS2 Directive Guide · Third-Party Access Guide · Global Cybersecurity Regulatory Map. This guide summarises regulatory expectations for identity in critical infrastructure and is not legal advice.

Critical Infrastructure Identity Security Guide: Access Control for Essential Services