OT and ICS Identity and Access Management Guide

Operational technology runs factories, pipelines, power, water, hospitals and transport, and its identity practices are often decades behind IT. Shared operator logins, default passwords on controllers, vendor accounts that never expire and remote access tools installed "temporarily" are common, partly because availability and safety come first and partly because much OT equipment was never designed for modern authentication. When identity fails in OT the consequences can be physical and costly, as production shutdowns at Colonial Pipeline and Jaguar Land Rover showed. This guide covers the identities in OT environments, the standards that apply, and practical identity controls that respect operational constraints.

Key takeaways

Most OT compromises start in IT or through remote access. Strong identity at the IT/OT boundary gives the biggest early gains.
Vendor and third-party remote access is the highest-risk identity path into OT. Broker, time-limit and record it.
Where devices cannot support individual accounts, compensate with PAM, session brokering and monitoring rather than accepting shared access.
IEC 62443 sets identification and authentication requirements for industrial systems.
Plan identity changes around safety and uptime, with operations as co-owners.

Identities in OT environments

Identity	Typical problem
Operators on HMIs and engineering workstations	Shared accounts, always-logged-in stations, no MFA
Engineers and administrators	Domain accounts shared between IT and OT; standing admin rights
Vendors and integrators	Permanent remote access accounts, shared credentials, tools installed outside change control
Controllers, PLCs and field devices	No authentication, or default and hard-coded credentials
Historians, SCADA servers and OT applications	Service accounts with broad rights and old passwords
Connected medical and building systems	Vendor-managed devices with limited visibility. See the Device and IoT Identity Guide

Standards and guidance

IEC 62443: the international series for industrial automation and control systems security. IEC 62443-3-3 defines system security requirements, with the first foundational requirement covering identification and authentication control for people, software processes and devices. IEC 62443-2-4 sets requirements for service providers, including their access.
NIST SP 800-82 Rev. 3 (2023) is the US guide to OT security, including access control and remote access.
Regulation: critical infrastructure rules such as the EU NIS2 Directive and sector-specific requirements increasingly expect MFA, access control and supplier security in OT. See the Identity Security Regulatory Map.

Controls that work in OT

Separate IT and OT identity

Use a separate OT directory or domain, or at least separate admin accounts, so a compromised IT domain does not grant OT control.
Do not let IT admin accounts log in to OT systems, and vice versa, without deliberate, logged elevation.
Protect the systems that connect IT and OT, such as jump hosts in a DMZ, as tier-zero assets.

Broker remote access

Route all remote access, including vendors, through a single brokered path with phishing-resistant MFA, approval and session recording. See the Remote Access Identity Guide.
Enable vendor access only for approved windows, then disable it automatically.
Remove direct remote desktop tools and unmanaged remote support software from OT networks.
Monitor sessions live for high-risk work. See the Privileged Session Management Guide.

Deal with shared accounts realistically

Where operators must share a station, use badge or fast user switching to attribute actions to individuals where the HMI supports it.
Where it does not, vault the shared credential, record who checked it out and when, and correlate with shift rosters.
Change default passwords on every device, and rotate shared credentials after staff and vendor changes.

Least privilege and privileged access

Separate operator, engineer and administrator roles, and restrict who can change logic or configuration.
Use just-in-time elevation for engineering changes, tied to change tickets. See the JIT Access Guide.
Inventory and restrict OT service accounts. See the Service Account Security Guide.

Segment by zone and conduit

IEC 62443 uses zones and conduits to group assets and control communication between them. Pair network segmentation with identity: only named, authenticated identities should cross a conduit, and every crossing should be logged. See the Zero Trust Identity Guide.

Planning around operations

Test authentication changes in a staging or maintenance window, never directly on running processes.
Design break-glass access for safety-critical situations where MFA or a network dependency could delay a response. See the Break-Glass Account Guide.
Avoid lockout policies that could block operators during an incident; use monitoring and alerting instead.
Involve plant and operations leaders as co-owners of access policy.

Lessons from incidents

Colonial Pipeline (2021): a dormant VPN account without MFA led to a precautionary shutdown of fuel distribution.
Jaguar Land Rover (2025): a cyberattack halted production for weeks, showing how IT compromise disrupts manufacturing even when the exact access route is not public.
Stryker (2026): a hijacked admin account in a device management platform wiped devices across the business.

Practitioner checklist

Inventory OT identities: operators, engineers, vendors, devices and service accounts.
Separate OT identity from the IT domain and protect IT/OT boundary systems as tier zero.
Broker all remote and vendor access with MFA, approval, time limits and recording.
Change default passwords and vault and attribute any shared credentials.
Separate operator, engineer and admin roles, with just-in-time elevation for changes.
Align zones and conduits with identity-based access and logging.
Test changes in maintenance windows and design safety-aware break-glass access.
Map controls to IEC 62443 and applicable regulation.

OT and ICS Identity and Access Guide