What breaks when cyber and physical access are governed separately in critical infrastructure?

Why This Matters for Security Teams

When cyber and physical access are managed in separate systems, the control story looks complete on paper while the real-world access picture is fragmented. That gap matters most in critical infrastructure because operators, contractors, and service accounts often cross both domains during normal work. A badge may be revoked while a remote admin path remains active, or a cyber account may be removed while physical entry still allows privileged access to sensitive rooms and devices.

The practical risk is not only unauthorised entry. It is also delayed detection, conflicting evidence, and weak accountability when an incident crosses operational technology, facilities, and IT boundaries. The NIST Cybersecurity Framework 2.0 is useful here because it treats governance, asset context, and access control as connected outcomes rather than separate checklists. That matters in environments where a single person can influence both digital systems and physical plant availability.

In practice, many security teams encounter this only after a maintenance change, contractor offboarding, or incident has already exposed the mismatch rather than through intentional cross-domain entitlement review.

How It Works in Practice

A safer operating model starts by treating identity as the common control plane for both cyber and physical access. That means one authoritative identity record, consistent joiner-mover-leaver processes, and access decisions that reflect role, location, time, and operational need across both domains. In critical infrastructure, this usually requires coordination between IAM, physical security, OT security, and site operations so that changes propagate in a controlled way.

Practitioners typically need three linked capabilities:

• Unified entitlement review so badge rights, VPN access, privileged sessions, and site permissions can be recertified together.
• Event correlation so a revoked contractor, an expired credential, or an abnormal plant access event is visible in the same investigation workflow.
• Exception handling for emergency response, where temporary access is time-bound, logged, and automatically removed.

This is also where NHI governance matters. In many plants, service accounts, API keys, badge controllers, and automation agents can all act without human presence. The OWASP Non-Human Identity Top 10 is relevant because these identities often outlive the person or process that created them. If physical access is revoked but an automation token still opens a management path, the gap remains exploitable.

For monitoring and response, teams should align detections with known abuse paths and threat reporting. CISA cyber threat advisories help prioritise active techniques, while ENISA Threat Landscape material is useful for understanding sector-specific risk patterns. Where identity flows intersect with automation and AI-assisted operations, current guidance suggests validating tool access, session boundaries, and command authority as part of the same review cycle. These controls tend to break down when physical security and IT operations use different owners, different ticketing systems, and different revocation triggers because no single team can see the full access chain.

Common Variations and Edge Cases

Tighter cross-domain governance often increases operational overhead, requiring organisations to balance faster access restoration against stronger revocation assurance. That tradeoff becomes sharper in critical infrastructure because outage recovery, emergency maintenance, and vendor support may need temporary exceptions that cannot wait for a full review cycle.

Best practice is evolving for environments that include OT, safety systems, and autonomous tooling. There is no universal standard for how to merge badge control, remote admin control, and privileged session governance, but current guidance suggests the review process should always resolve to one entitlement view. NIST CSF and EU NIS2 Directive both reinforce the need for coordinated governance, while NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for mapping access, audit, and accountability requirements.

Edge cases include shared control rooms, roaming contractors, and site rescue roles, where physical presence is legitimate but cyber privilege should still be minimal and time-limited. The hardest failure mode is a partially deprovisioned identity that remains trusted by one system after it has been removed from another. That is especially dangerous when AI-enabled assistants or automation scripts can act on behalf of human operators without a clear non-human identity inventory.

Related resources from NHI Mgmt Group

• What breaks when vendor access is not tightly controlled in critical infrastructure?
• What breaks when AI access is governed separately from human and NHI access?
• What breaks when privileged access is not continuously governed?
• What breaks when vendor access is not governed before a SaaS incident?