Why does OTCC-1:2022 matter for critical infrastructure operators that rely on third-party OT systems and suppliers?

What OTCC-1:2022 is really pushing operators to change

OTCC-1:2022 matters because it changes the question from “can the supplier connect?” to “can we govern that connection as part of the plant’s operating model?” For critical infrastructure, third-party OT access often touches engineering workstations, remote support paths, asset visibility tools, and change processes, so the control focus is on who can reach what, under which conditions, and with what oversight.

The practical value is that it treats supplier access as an operational dependency, not a one-time procurement issue. That means access approval, scope, logging, time limits, and revocation need to be part of how the site runs, not improvised after a maintenance request or incident.

Where this is done well, operators have a clear map of supplier pathways, documented ownership for each relationship, and reviewable evidence that access is limited to the minimum required task and duration.

Why third-party OT access becomes a system-level exposure

Third-party OT access becomes dangerous when the supplier’s account, remote tool, or support channel inherits trust into production, safety, or availability domains. In that situation, one weak supplier practice can become a direct path into systems that operators cannot easily afford to lose or interrupt.

That is why the issue is bigger than credential hygiene. Supplier access can create hidden privilege chains, unobserved remote sessions, stale accounts, and dependencies on vendor support workflows that are hard to audit in real time. The exposure grows further when multiple suppliers share the same plant, remote access broker, or maintenance window process.

Operators should also expect CISA Industrial Control Systems guidance to reinforce the same reality: OT environments need tighter handling of remote connectivity, segmentation, and operational constraints than ordinary enterprise IT.

What good governance looks like for suppliers, tools, and response

Good governance starts with proving that every third-party connection is needed, bounded, and removable. That includes formal sponsorship, explicit approval scope, session oversight, and a fast path to disable access when a contract ends, a system changes, or the supplier relationship becomes risky.

It also means reviewing the architecture around the connection, not just the account. If a supplier uses a remote support platform, shared jump host, VPN, or integration account, the operator should understand what else that path can reach, how it is logged, and how quickly it can be cut off during an event.

For broader supplier and third-party governance, the Third-Party, B2B and Contractor Access Guide is the most direct internal reference for sponsorship, federation, least privilege, time limits, and reviews, while IAM and IGA Basics is useful for the access-review and entitlement side of the problem.

When the supplier relationship is software-mediated, not just human-mediated, SaaS-to-SaaS and OAuth App Governance Guide helps translate the same governance idea into token, consent, and revocation discipline.

Risk and Threat Considerations

Third-party OT access concentrates risk because a compromise in the supplier path can bypass normal perimeter assumptions and land inside operational networks with high consequence. The main threat is not only theft of a password or token, but the abuse of a trusted remote path to reach production systems, alter settings, or interfere with availability.

Failure mechanism: Supplier access is often persistent, overbroad, or insufficiently monitored, so a stolen credential, compromised support tool, or abused integration can be used to move from vendor trust into plant-impacting systems before defenders notice.

Impact: That can produce loss of visibility, delayed incident response, unsafe change, service interruption, or a wider compromise path across OT and adjacent enterprise systems.

For operators, the important question is whether the third-party path is merely documented, or genuinely controlled. OTCC-1:2022 matters most where a supplier can still reach critical systems after its task should have ended, because that is where exposure turns into operational fragility.

Practitioner Guidance

What to verify: Confirm that every supplier path has an owner, an expiry condition, and a revocation method that works during an incident, not just during routine administration. If you cannot disable the path quickly, the control is incomplete.

Decision rule: If a third party can reach production OT or safety-adjacent systems, treat the connection as a high-risk operational dependency and require tighter scoping, logging, and review than for ordinary enterprise access.

What good looks like: The operator can show who approved the access, what systems it could reach, when it was last used, and how the supplier relationship would be cut off if trust changed.

Practitioner takeaway: In critical infrastructure, the test is not whether a supplier is trusted, but whether that trust is continuously bounded, observable, and revocable before it becomes a production failure.

Related resources from NHI Mgmt Group

• How should energy and critical infrastructure teams reduce third party breach risk across suppliers and contractors?
• How should critical infrastructure operators reduce third-party ICS integrator risk without blocking necessary work?
• Who is accountable when a third-party identity can reach critical infrastructure?
• Why do access logs matter more when organisations rely on third parties and hybrid systems?