Because connectivity turns identity into the main enforcement point for operational reach. Once engineering systems, vendor support, and machine-to-machine traffic cross network boundaries, weak credentials or shared accounts can become direct paths into production. The more connected the environment, the more access governance determines operational risk.
Why connected OT changes the identity problem
In an isolated plant, access is usually bounded by physical separation, local operator workflows, and a relatively small set of trusted users. Once OT is connected to enterprise networks, remote support, cloud services, or machine-to-machine integrations, identity becomes the practical control plane for who can reach controllers, historians, engineering workstations, and support tools. That shift is why OT and ICS Identity and Access Guide matters: the subject is no longer just equipment security, but governed operational reach.
Connected OT also changes the blast radius of a mistake. Shared accounts, weak authentication, or overbroad privileges are no longer minor administrative issues, because they can expose production logic, safety-relevant functions, and maintenance paths that were previously insulated by network isolation. In that setting, access decisions are part of operational design, not just IT administration.
Identity and access controls therefore matter more because they become the boundary between legitimate operations and unsafe or unauthorized changes. The question is not whether access exists, but whether it is specific, auditable, and limited enough that remote administration and vendor support do not become standing production access.
What fails first when OT connectivity expands
The first failure is often credential reuse. In a connected environment, one leaked password, shared vendor login, or unrotated service account can be enough to move from a low-trust entry point into systems that control production. That is why identity hygiene is central to OT risk, and why the IAM and IGA Basics guide is relevant here: governance is what keeps access from drifting faster than the plant changes.
The second failure is privilege creep. OT teams often create broad access to keep operations moving, then leave it in place because downtime is expensive and change windows are narrow. Over time, this produces standing access that is hard to justify and harder to monitor. Once connectivity expands, that overreach is no longer just inefficient, it becomes a direct attack path and a resilience problem.
The third failure is identity sprawl across vendors, plants, and support tools. As more systems talk to each other, it becomes easy to lose track of which account belongs to which function, which credentials are still active, and which third party can reach which segment. A lifecycle view helps here, especially the discipline in NHI Lifecycle Management Guide, because OT access only remains safe when provisioning, rotation, review, and offboarding are treated as operational controls.
Why governance, segmentation, and support access must work together
Connected OT does not need identity controls in isolation, it needs identity controls that align with segmentation and operational workflows. If remote support, maintenance, and machine-to-machine traffic are allowed without strong authorization boundaries, segmentation alone will not stop misuse. That is why the Authorisation Models Guide is useful: different access models help express who may act, under what conditions, and for which asset or function.
In OT, the practical goal is to keep access narrow without making operations brittle. Role-based access can work for stable job functions, but it often needs to be supplemented with attribute- or relationship-based rules where vendor scope, site, shift, asset class, or maintenance status changes the decision. That is especially important when support access must be temporary, approved, and traceable rather than permanent.
When the environment includes human operators and machine identities together, the same governance logic has to cover both. The difference is not just scale, but consequence. A permissive account in a connected plant can bridge business systems, engineering tools, and production systems in ways that isolated OT simply did not permit.
Risk and Threat Considerations
Connected OT increases the chance that compromised credentials, excessive privileges, or weak vendor access will translate directly into production impact. Attackers value these paths because they can provide persistence, lateral movement, and leverage over processes that are difficult to interrupt once active.
Failure mechanism: Shared logins, stale support accounts, or poorly scoped machine access let an attacker authenticate as a trusted user or service and then move into higher-value OT functions without needing to defeat the control layer first.
Impact: The likely result is unauthorized operational change, loss of visibility, unsafe configuration drift, delayed recovery, or production disruption that extends beyond the original compromised system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Connected OT needs strong user authentication for operators and admins reaching production systems. |
| IA-5 — Authenticator Management | OT risk rises when passwords, tokens, and service credentials are shared, stale, or unrotated. | |
| AC-6 — Least Privilege | Overbroad access in connected OT directly increases the blast radius of compromise and misuse. | |
| Recommendation — Enforce strong user authentication for OT administrative and operator access. Rotate and manage OT credentials with defined ownership, expiry, and recovery procedures. Limit OT accounts to the minimum access needed for each function. | ||
| CIS Controls v8 | CIS-5 — Account Management | OT environments fail when shared, dormant, or vendor accounts are not governed across the lifecycle. |
| Recommendation — Inventory, review, and remove OT accounts that no longer have a justified purpose. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Connected OT requires formal access control rules for cross-boundary operational access. |
| A.8.5 — Secure authentication | Weak authentication is a primary failure mode when OT access becomes remote or interconnected. | |
| Recommendation — Define and enforce OT access rules for users, vendors, and systems. Require secure authentication for OT access paths and administrative functions. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Stolen or reused credentials are a common route into connected operational environments. |
| T1021 — Remote Services | Remote support is a key exposure point when OT is connected to external access channels. | |
| Recommendation — Detect and investigate use of valid accounts for unusual OT access patterns. Harden and monitor remote services used to reach OT assets. | ||
Practitioner Guidance
What to prioritise: Start with any account that can reach production remotely, any shared account used by vendors or integrators, and any service or machine credential that is not clearly owned, rotated, and reviewed. In connected OT, those are the accounts most likely to determine whether access stays bounded or becomes a production path.
What to verify: Confirm that each privileged OT account has a named owner, a defined scope, a rotation or expiry rule, and a reason to exist in its current form. If you cannot explain why an account must remain active, it is already a governance problem.
Decision rule: If an identity can touch engineering workstations, controllers, remote support channels, or OT management planes, treat it as production-grade access and apply stronger review than you would for ordinary IT access. In connected plants, “temporary convenience” often becomes permanent risk.
Practitioner takeaway: Connected OT changes the security question from “can someone reach the network?” to “can a specific identity safely reach a specific operational function?” The tighter and more observable that answer is, the lower the production risk.
Related resources from NHI Mgmt Group
- Which identity controls matter most when OAuth is used for AI agent tool access?
- Which identity governance controls matter most when ITSM platforms handle app access?
- Why do runtime identity controls matter more than periodic access reviews?
- Which identity controls matter most when hospitals modernise clinical access?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org