Emerson DeltaV Security Guide: Accounts and Hardening

Emerson DeltaV gives asset owners locked-down switches, a controller-side firewall, smart card logon and version-controlled configuration, but most of that protection depends on choices the site makes when it designs, commissions and runs the system. DeltaV is a distributed control system (DCS) widely used in pharmaceuticals, chemicals, life sciences and other process industries, with DeltaV SIS as its companion safety system. Workstations and servers run Windows, while controllers, CHARM I/O cards and other embedded nodes sit on the DeltaV Area Control Network (ACN). This guide explains how identity and access work in DeltaV, which privileges matter most, how to treat service accounts and integrations, what to log, and a hardening baseline built on Emerson's public documentation. It goes deeper than the Pharma and GxP Cybersecurity Guide and the Distributed Control System (DCS) Security Guide, and is written for DCS engineers, OT security teams and validation leads. Detailed configuration steps sit in the DeltaV Security Manual and DeltaV Books Online, which Emerson provides to customers through Guardian Support, so confirm names and menus for your release there.

This is an independent guide from NHI Mgmt Group, based on Emerson's public documentation as of November 2026. It is not sponsored or reviewed by Emerson. Product features change, so confirm settings against Emerson's current documentation.

Key takeaways

Deploy DeltaV in a domain. Emerson's ISASecure certified architecture requires a domain, and features such as Credential Guard and smart card logon depend on Active Directory.
Privileges such as Can Configure and Can Download are the keys to the process. Grant them through DeltaV User Manager to named engineers only, and review them on a schedule.
Lock the network, not just the hosts. DeltaV Smart Switches disable unused ports with Auto Security Lockdown, and the DeltaV Firewall-IPD blocks unlock commands to controllers and logic solvers unless someone is physically present.
Use the strong authentication options. Smart card two-factor logon can be made mandatory per workstation in DeltaV FlexLock, and Credential Guard protects domain credential hashes from v14.3.
Keep the certified architecture intact. Antivirus, application allowlisting, a perimeter firewall and Smart Switches are all required parts of the ISASecure SSA Level 1 architecture, so removing one takes the system outside it.

How identity and access work in Emerson DeltaV

DeltaV uses Windows for authentication and adds its own privilege model on top. Users are managed in DeltaV User Manager, which Emerson lists among DeltaV security features in its Cybersecurity Guidebook for Process Control. The privileges assigned there decide what a person can configure, download, operate or tune, and Emerson's data sheets refer to them by name: only users with Can Configure or Can Download privileges can commission or lock DeltaV Smart Switches, for example.

Domain design

Emerson's ISASecure SSA FAQ states that a DeltaV system must be deployed in a domain to match the certified architecture. The Credential Guard and Device Guard white paper adds that from v14.3 the Independent DeltaV Domain Controller (IDDC) is available and all DeltaV service accounts are domain members. The public table of contents of the DeltaV Security Manual (V5.1.1, August 2020) shows the areas Emerson covers for customers: Active Directory design for DeltaV, centralised account management, account expiration, removal of unused accounts, default passwords, password complexity and reuse, shared accounts, installation-generated user accounts and account activity logging.

Identity layer	What it controls	Customer action
Windows domain (IDDC from v14.3)	Logon to DeltaV workstations and servers, service accounts, Group Policy	Keep the DeltaV domain separate from the corporate domain; deploy redundant domain controllers
DeltaV User Manager	DeltaV privileges such as Can Configure and Can Download	Map roles to privileges, use named accounts, review quarterly
DeltaV FlexLock	Workstation logon behaviour, including the Smart Card Required option	Enable Smart Card Required on ACN workstations and servers
Smart Switch local users	Switch management, with roles that set privilege level and SNMP v3 access	Change the default Admin password through NDCC; assign least-privilege roles
SIS logic solver locks	Changes to DeltaV SIS logic solvers	Use hardware key switches or Firewall-IPD unlock protection

Whatever the design, give every person a named account. Emerson's guidebook advises simplifying user access, avoiding shared accounts and periodically reviewing privileged permissions. The OT and ICS Identity and Access Guide covers domain separation options in more depth.

Admin roles and privileged access

An attacker with Valid Accounts (T0859) and the right DeltaV privileges can download changed logic (T0843) or modify parameters (T0836). Treat the following as privileged and control them accordingly:

Privilege or role	What it allows (Emerson public docs)	Control
Can Configure, Can Download	Change and download configuration; commission or lock Smart Switches	Named engineers only, tied to change records, used from engineering workstations
Domain and local administrators	Full control of Windows nodes; interactive admin accounts can defeat Credential Guard	Few named people, separate admin accounts, dedicated workstations for high-value accounts
Smart Switch roles	Switch configuration and SNMP v3 access according to role	Least-privilege role per user; admin role for network owners only
Recipe and SIS approvals	Electronic signature approvals for recipe release, SIS module download and SIS testing	Different people for author and approver
Remote users	Access from outside the ACN	View-only by default, temporary write access under local supervision

Separate daily and admin identities: the Credential Guard white paper recommends dedicated workstations and servers for high-value accounts. Operators and engineers use standard accounts; Windows administration uses separate accounts. See the Privileged Access Workstations Guide.
Require smart card logon: Emerson's smart card two-factor white paper (September 2022) describes an optional mode, where the user ticks Use Smart Card Logon in the DeltaV logon dialog, and a required mode, where administrators enable Smart Card Required per workstation in DeltaV FlexLock. The setting persists through upgrades, and Emerson recommends the required option on all ACN workstations and servers. It needs Active Directory, a Windows Server Certificate Authority and contact smart card readers, and is supported from DeltaV v9.3. See the Smart Card and PIV/CAC Authentication Guide.
Restrict remote privilege: the guidebook recommends starting remote users with view-only permissions, granting temporary write access only under local supervision, never allowing administrative or safety-related access remotely, keeping separate accounts for remote and local privileged use, and routing remote connections through jump servers. The smart card paper notes that smart card credentials can pass through Remote Desktop, so block remote connections on local-only workstations and use a Remote Desktop Gateway. See the OT Remote Access Guide.
Protect the safety boundary: Emerson's DeltaV SIS Security and Networks page describes configurable user privileges, soft and physical logic solver locks, a hardware key switch on the CHARMs Smart Logic Solver that requires physical presence before changes apply, two-factor authentication for downloads and bypass alerts. See the Safety Instrumented Systems Security Guide.

Integrations, API tokens and service accounts

DeltaV's non-human identities include the service accounts created during installation, accounts used by historians, MES and batch integrations, OPC clients, backup tools and the local users on network devices. These often hold broad access and are rarely reviewed.

Service accounts: from v14.3 all DeltaV service accounts are domain members, and the Credential Guard white paper warns that interactive or local service accounts with administrative privileges can defeat Credential Guard. Do not log on interactively with service accounts, record an owner for each, and follow Emerson's documented procedure for changing their passwords. The security manual's contents list installation-generated user accounts as a topic, so review them after every installation or upgrade.
Integration accounts: give each external system its own account with only the privileges it needs, usually read access, and a named owner. Never run an interface under an engineer's or administrator's account. The Windows Services and Service Account Security Guide covers ownership and rotation.
Network device credentials: the DeltaV Smart Switches data sheet (December 2023) says the default Admin password can be changed separately from DeltaV and Windows passwords, that the NDCC user password must be changed only through the DeltaV Network Device Command Center, and that SSH is used for console access with Telnet disabled by default.
Data out of the ACN: route business-system reads through a DMZ with the perimeter firewall Emerson requires at level 2.5, rather than opening paths into the control network. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide and the OPC UA Security Guide.

Logging and detection

Emerson's guidebook recommends a SIEM that collects firewall syslog events, Windows workstation events and switch SNMP data, and a move toward network security monitoring of control system communications. Build detection from these sources:

Source	What it records	Watch for
DeltaV Event Journal	Smart Switch lock and unlock events	Unlocks outside change windows
Smart Switches (console or Syslog)	ARP poisoning detection, high traffic suggesting denial of service, port-lock violations	Any ARP alert or port violation
Firewall-IPD log	Communication logging, collected on an external computer and reviewed for unauthorised access; LAND attack packets are dropped and logged	Bypass activations and blocked traffic to embedded nodes
Version Control and Audit Trail	Who, what and when for checked-in configuration, including User Manager configuration and user accounts	Changes without an approved change record
Windows security logs	Logons, account and group changes, service installs	Interactive logons by service accounts, new admin group members

Emerson's Version Control and Audit Trail data sheet describes check-in records with time stamp and user name, item history logs, version comparison, rollback of an item or the whole database, and one to five electronic signature approvals for recipe release, which supports GxP change control. Emerson also offers a SIEM for DeltaV systems and a passive threat monitoring service that receives mirrored traffic from Smart Switches and compares flows against a baseline set at commissioning, according to its threat monitoring service data sheet (September 2023). Forward Windows events with the method in the Windows Event Forwarding Guide, and see the OT Network Security Monitoring Guide.

Metrics

Number of users holding Can Configure or Can Download, reviewed quarterly against a named list.
Percentage of ACN workstations and servers with Smart Card Required enabled.
Percentage of downloads and configuration check-ins that match an approved change record.
Number of Smart Switch unlock events and Firewall-IPD bypass activations outside approved windows (target: zero).
Percentage of DeltaV nodes at the current Emerson-approved Windows update and DeltaV hotfix level.
Number of interactive logons by service or shared accounts (target: zero).

Hardening baseline

Emerson's public pages state that DeltaV workstations use hardened operating system templates with unused services disabled, and the ISASecure FAQ lists what the certified architecture requires: DeltaV Smart Switches on the control network, the Firewall-IPD for 14.3 FP1 (recommended for 14.FP1), CHARM I/O Card version 2 with Electronic Marshalling, antivirus and application allowlisting, an L2.5 perimeter firewall and a domain. Optional items include a SIEM, Network Security Monitor, DeltaV Backup and Recovery, tested USB scanning, the Emerson Smart Firewall, automated patch management and two-factor authentication. Build the baseline in this order:

Inventory: list every node, its role, DeltaV version, Windows build, controller and switch firmware and network placement. See the OT Asset Visibility Guide.
Perimeter and zones: place the L2.5 perimeter firewall between DeltaV and the plant or business network, and keep workstations off the secure side of any Firewall-IPD.
Lock switches: run Auto Security Lockdown from NDCC so unused ports are disabled, use the optional 60-minute relock timer, and document every port exception.
Protect embedded nodes: install the Firewall-IPD close to controllers and logic solvers where the risk assessment calls for it. Per its data sheet (June 2024), it starts protecting at power-up with factory rules, blocks DeltaV Unlock and SIS Unlock messages unless bypassed by a physical action, and its front panel bypass resets after 30 minutes. Embedded node locking needs DeltaV v13.3.1 or later; a locked node blocks downloads, firmware upgrades and decommissioning.
Clean up identities: remove unused and default accounts, enforce password policy through the domain, enable Smart Card Required, and enable Credential Guard on v14.3 or later with UEFI Secure Boot and TPM 2.0. If you add Credential Guard to an existing system, change all user passwords, and disable credential caching.
Endpoint controls: keep antivirus and application allowlisting active as the certified architecture requires, and scan removable media at a kiosk. See the OT Endpoint Protection Guide and the Removable Media and USB Control Guide.
Patch with approved updates: Emerson's security manual covers Microsoft Windows updates, security updates and DeltaV hotfixes. Apply only updates Emerson has approved for your release, test on a spare or virtual node first, and subscribe to advisories through the Emerson Trust Center described in its coordinated vulnerability disclosure policy. Apply Emerson security updates promptly.
Back up and rehearse: keep offline backups both onsite and offsite, as the guidebook recommends, and test a restore. Note that Secure Boot may need to be disabled temporarily to restore a full image with DeltaV Backup and Recovery. Rollback for any hardening step is a restore of the pre-change backup. See the OT Backup, Recovery and Golden Image Guide.

Decision guidance

Firewall-IPD or not: Emerson describes it as an optional layer recommended when a risk assessment calls for it. Choose it where SIS logic solvers or critical controllers share a network with workstations, and use the 1:N layout with a Smart Switch (up to eight nodes) for larger cabinets.
Smart card rollout: start with the optional mode for a pilot group, then move to Smart Card Required. Keep a documented break-glass process for card or CA failure.
Regulated GxP sites: use Version Control and Audit Trail with electronic signature approvals, separate author and approver groups, and keep audit records for the period your quality system requires.
Small sites: the domain requirement still applies to the certified architecture; redundant IDDCs on the DeltaV network keep identity local to the plant.

Framework mapping

Framework	Reference	DeltaV control
NIST SP 800-53 Rev. 5	AC-2, AC-6, IA-2	User Manager privileges, named accounts, smart card logon
NIST SP 800-53 Rev. 5	AU-2, AU-12	Event Journal, Version Control and Audit Trail, Windows and switch logs
NIST SP 800-53 Rev. 5	CM-7, SI-2, SC-7, CP-9	Hardened templates, approved updates, Smart Switch lockdown and firewalls, backup
NIST CSF 2.0	PR.AA-01, PR.AA-05, PR.PS-02, DE.CM-01	Identity, permissions, patching and network monitoring
ISA/IEC 62443	62443-3-3, 62443-4-1	Emerson reports ISASecure SSA Level 1 for DeltaV DCS and SIS 14.3 FP1 and 14.FP1, and SDLA Level 1 for its Austin and Manila development sites, certified by exida. See the IEC 62443-3-3 and 4-2 Security Levels Guide
MITRE ATT&CK for ICS v20	T0859, T0886, T0843, T0836	Techniques the identity, remote access, download and lock controls address

Common misconfigurations

Shared console logins: one account per shift or per area, so the audit trail cannot attribute downloads or parameter changes.
Switches left unlocked: Auto Security Lockdown never run after commissioning or after maintenance, leaving unused ports open for a rogue device.
Default switch credentials: the Smart Switch Admin password left unchanged, or changed through the web interface instead of NDCC.
Firewall-IPD left in bypass: a hard-wired or engineered bypass that is never removed, so unlock commands reach logic solvers without physical presence.
Interactive service accounts: service or local admin accounts used for daily work, which defeats Credential Guard and blurs accountability.
Remote admin access: remote users given write or administrative rights by default, against Emerson's guidance to start view-only and supervise write access locally.

Practitioner checklist

Confirm DeltaV runs in its own domain with redundant domain controllers, separate from corporate identity.
Review Can Configure and Can Download holders quarterly against a named list.
Enable Smart Card Required in DeltaV FlexLock on ACN workstations and servers.
Enable Credential Guard on v14.3 or later and disable credential caching.
Give every service and integration account an owner and block interactive use.
Run Smart Switch Auto Security Lockdown and change the default Admin password through NDCC.
Assess the Firewall-IPD for controller and SIS networks, and audit bypass use.
Forward Event Journal, switch, firewall and Windows logs to the OT SIEM.
Apply only Emerson-approved updates and subscribe to Emerson security advisories.
Keep onsite and offsite backups and rehearse a restore.

Emerson DeltaV Security Guide: Accounts, Network Lockdown, Logging and Hardening