Utilities should modernize on a long horizon, but they should not wait for replacement before reducing trust. The practical balance is to externalise MFA, segment access to specific assets, record privileged sessions and remove direct exposure now, while capital plans handle device renewal later.
Why modernization and access control should move on different clocks
Utilities do not need to finish replacement projects before improving control of who can reach what. The practical split is to treat modernization as a capital and engineering programme, while access control is an immediate operational safeguard. That means reducing standing trust around critical systems now, even if the underlying devices, protocols or platforms remain in place for several years.
The reason this matters is simple: aging infrastructure often persists longer than the security appetite for direct access should. If remote access, shared accounts or broad network reach remain in place until the last upgrade is complete, the organisation inherits the highest-risk parts of the old environment for the entire transition period.
For access design, the useful question is not whether a system is legacy, but whether a person or tool needs broad reach to perform a narrow task. Utilities get better results when access is tied to specific assets, specific roles and specific time windows, rather than to entire environments or flat operational networks.
Controls that reduce exposure before replacement
Externalised MFA, segmented access paths and recorded privileged sessions are the most practical near-term measures because they reduce blast radius without waiting for device replacement. Those controls are especially valuable where operational continuity makes shutdowns or re-architecture unrealistic. A mature Authorisation Models Guide helps frame how RBAC, ABAC and policy-based decisions can constrain reach more precisely than site-wide trust.
Session recording and just enough access matter because utilities often need maintenance, vendor support and emergency operations under one roof. The issue is not whether those activities are legitimate, but whether they are separately governed. If the same account can browse, administer and make changes across multiple assets, the control plane is too coarse for a modern threat model.
Good balance also means separating user authentication from system authorisation. A strong sign of progress is when login becomes a gateway into a controlled workflow, not a blanket pass into the operational network. That is why identity governance, entitlement review and clear access ownership become more important as the environment becomes more hybrid and more remotely operated. IAM and IGA Basics is useful here because it connects access review, entitlement management and least privilege to the real problem of phased modernisation.
When legacy access is unavoidable, limit it to the smallest possible scope. The default should be denial, with exceptions made explicit, time-bound and observable. That principle is more effective than trying to make old environments “safe enough” through policy alone.
How to manage the transition without creating a new risk window
The transition period is where utilities most often get caught: they keep legacy pathways alive for availability, then forget to retire them after the migration milestone passes. Every exception should therefore have an owner, an expiry date and a documented business reason. If an access path cannot be described that way, it is probably not an exception, it is a permanent exposure.
Vendor access deserves special handling because it often survives longer than internal operational need. If a third party still needs access to support old equipment, that access should be isolated from normal user paths and reviewed against the specific asset or function it supports. Network Access Control (NAC) Guide is a useful companion for thinking about how access can be narrowed by device posture and network placement rather than by broad trust.
Utilities should also avoid treating modernization as a reason to postpone logging. If privileged sessions are not recorded now, the organisation loses forensic visibility during the exact period when old and new controls overlap. That overlap is where misuse, misconfiguration and weak handoffs are most likely to hide.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Utilities need strong user authentication for privileged operational access. |
| AC-6 — Least Privilege | The question centers on limiting broad access while legacy systems remain online. | |
| AU-12 — Audit Record Generation | Privileged session recording and access visibility are central to the balance described. | |
| Recommendation — Enforce strong authentication for staff and admins before granting operational access. Restrict each account to the minimum operational access needed. Generate audit records for privileged actions and remote sessions. | ||
| CIS Controls v8 | CIS-5 — Account Management | Balancing modernization with access control requires governing accounts and privileged access. |
| Recommendation — Inventory, review and remove unnecessary accounts and privileged access paths. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control is the direct governance mechanism for phased modernization. |
| Recommendation — Apply formal access control rules to legacy and modern systems alike. | ||
Practitioner Guidance
What to prioritise: Start with the access paths that can reach the most critical operational assets, not with the oldest asset first. Broad remote administration, shared privileged accounts and unmanaged vendor channels usually deliver the fastest risk reduction when tightened.
Decision rule: If an access path can authenticate into production, treat it as a control issue even if the asset itself is not yet being replaced. If the business cannot remove the path immediately, constrain it with MFA, segmentation and session visibility rather than accepting standing trust.
What good looks like: The utility can show which people, vendors and tools can reach each critical asset, why they have that reach and when it was last reviewed. Modernization may still be underway, but access should already be narrower, recorded and easier to revoke.
Practitioner takeaway: The safest modernization programmes reduce trust first and replace technology second; otherwise the organisation carries legacy exposure for the entire lifecycle of the upgrade.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 21, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org