Remote sessions into operational technology are where IT-style convenience meets safety-critical equipment, and most sites still approve them by phone call or email with no record of who connected, to what, or why. A per-session request form turns that into a controlled, auditable step: every vendor or engineer session is tied to a work order, a named person, a list of assets, a time window and a monitoring decision before the connection is enabled. This template gives you a ready-to-use OT remote access request form, an approval route by risk, and the pre-session, in-session and close-out checks. It is for OT security, plant operations and engineering teams running remote access for vendors, integrators and internal staff. The architecture and controls behind it are in the OT Remote Access Guide, and the policy wording is in the Remote Access Policy Template.
How to use this template
- Replace text in square brackets, such as [Site], [OT security lead] and [4 hours], with your own roles and values. Values in brackets are NHI Mgmt Group suggestions; adjust them to your safety case and regulatory obligations.
- Section 3 is the form. Build it into your work order or ITSM system so that a session cannot be enabled on the remote access broker without an approved request number.
- Use it for interactive sessions (a person at a screen) and for system-to-system connections (vendor telemetry, remote monitoring, cloud analytics). NERC CIP-005-7 treats both as vendor remote access that entities must be able to see and disable. CIP-005-7 is the enforceable version as of November 2026; CIP-005-8 is listed with a future enforcement date of 1 July 2028, so check the version that applies to you.
- The form assumes remote access goes through your own brokered path (intermediate system or jump host in a DMZ), as described in the OT Remote Access Guide. Sessions through vendor-installed tools or cellular modems are not approvable under this form.
1. Purpose
This form controls every remote connection into [Organisation]'s OT environments at [Site]. It makes sure each session is necessary, approved by the asset owner, limited to named assets and a fixed time window, authenticated with multi-factor authentication, monitored in proportion to risk, and closed and reviewed afterwards. No remote access account is enabled and no connection is permitted without an approved request, except under the emergency route in section 6.
2. Scope
- Vendor, integrator and original equipment manufacturer (OEM) engineers connecting for support, maintenance, commissioning or warranty work.
- Internal staff connecting from outside the OT network, including from the corporate IT network.
- System-to-system connections from vendor platforms, remote monitoring services and cloud analytics into OT zones.
- All OT zones at [Site], including safety instrumented systems (SIS), which require the highest tier in section 4.
3. Request form fields
3.1 Who is connecting
| Field | Required | Guidance |
|---|---|---|
| Requester | Yes | Named person raising the request (often the internal sponsor). |
| Connecting person | Yes | Full name of each individual who will connect. One named account per person; shared vendor logins are not accepted. |
| Company | Yes | Vendor or integrator name, and contract or purchase order reference. |
| Internal sponsor | Yes | Employee accountable for the vendor during the session. |
| Remote access account | Yes | Account name on the broker. Must already exist, be tied to the named person and be disabled when not in use. |
| Connecting from | Recommended | Vendor office, home or third-party network; source IP range where it is fixed. |
3.2 Why and what
| Field | Required | Guidance |
|---|---|---|
| Work order or change number | Yes | Every session is tied to a planned work order or approved change. No reference, no session. |
| Reason | Yes | Fault diagnosis, firmware or software update, configuration change, logic change, commissioning, data retrieval. |
| Why on-site or supervised alternative is not used | Yes for High and Critical | Short justification. Remote access is a risk-based trade-off, not the default. |
| Target assets | Yes | Asset tags or names (HMI, engineering workstation, PLC, historian). "Whole zone" is not accepted. |
| Zone or conduit | Yes | OT zone and Purdue level of each asset. |
| Actions planned | Yes | View only · read data · change configuration · change logic or setpoints · install software or firmware. |
| File transfer needed | Yes (Yes/No) | If Yes, files go through [file transfer and malware scanning process], not clipboard or drive redirection. |
| Rollback plan | Yes for changes | How the change is reversed, and who on site can do it. |
3.3 When
| Field | Required | Guidance |
|---|---|---|
| Session start and end | Yes | Exact window. NHI Mgmt Group suggests no more than [4 hours] per approval; longer work is split into separate approved windows. |
| Operating state | Yes | Running · reduced load · planned outage. Changes to running processes need operations sign-off. |
| Site contact during session | Yes | Name and phone number of the on-site person who can halt the session and the process. |
3.4 Access and monitoring controls
| Field | Required | Allowed values |
|---|---|---|
| Access path | Yes | [Approved broker or intermediate system] only. |
| Authentication | Yes | MFA at the broker and at the internal jump host. Phishing-resistant MFA where supported. |
| Device credentials | Yes | Injected from vault (vendor never sees the password) · temporary credential issued for this session · vendor's own account on device (exception). |
| Monitoring level | Yes | Recorded · recorded and live-watched by [site engineer] · recorded, live-watched with ability to terminate (required for logic, setpoint or SIS work). |
| Session restrictions | Yes | Clipboard and drive redirection off; idle disconnect after [15 minutes]; automatic disconnect at window end. |
4. Risk tier and approval route
| Tier | Triggers (any one) | Approvers | Monitoring |
|---|---|---|---|
| Critical | SIS or safety-related assets; logic or setpoint change on a running process | Asset owner, operations shift lead, [OT security lead] and process safety | Live-watched with terminate capability |
| High | Configuration or software change; engineering workstation access; file transfer into OT | Asset owner, operations shift lead and [OT security lead] | Live-watched and recorded |
| Medium | Read data or diagnostics on a single asset, no changes | Asset owner and operations shift lead | Recorded |
| Low | View-only access to historian or reporting data outside control zones | Asset owner | Recorded |
The internal sponsor cannot be the only approver. Approvals are recorded in the request, not by phone. For approval design in general, see the Access Request and Approval Workflow Design Guide.
5. Session checks
5.1 Before the session
- Request approved at the required tier; work order is open and matches the assets listed.
- Remote access account enabled only for the approved window, with access limited to the listed assets.
- Site contact confirmed and available; operations aware of the session.
- Vault credential checkout or temporary credential prepared.
5.2 During the session
- Connecting person authenticates with MFA at each hop; the site contact confirms identity verbally for Critical and High sessions.
- Monitoring runs at the approved level. The watcher terminates the session if activity goes beyond the approved actions or assets.
- Any extension beyond the window needs a fresh approval recorded in the request.
5.3 After the session
- Session disconnected and remote access account disabled automatically at window end.
- Vaulted device credentials rotated where they were exposed to the session.
- Changes compared with the configuration baseline; differences reconciled with the work order.
- Recording retained for [12 months] and reviewed for all Critical and High sessions within [5 working days]. See the Privileged Session Review Checklist.
6. Emergency access
Where a fault threatens safety or production and the normal approval cannot be obtained in time, the operations shift lead may approve a session alone, using the same broker and MFA, with live monitoring. The full request is completed within [1 working day] and reviewed by [OT security lead]. Emergency access never uses ad hoc tools or direct connections. See the Break Glass Access Procedure Template.
7. System-to-system connections
Persistent vendor connections (telemetry, remote monitoring, predictive maintenance) are approved once with this form and recertified every [6 months]. The request records the vendor service identity, its credential and where it is stored, the data flows (direction, protocol, port), the assets reached and how the connection is disabled in an incident. Inventory these alongside interactive access so you can see and cut every active vendor connection, as CIP-005-7 Parts 2.4 and 2.5 expect of covered entities.
8. Records and review
- Keep requests, approvals, recordings and close-out checks for [the period set by your regulator or 3 years].
- Review the request log each quarter: sessions without a work order, windows extended, accounts left enabled and sessions outside approved hours.
Implementation guidance
- Remove the alternatives first: the form only works if the broker is the only way in. Find and remove unmanaged remote access tools, modems and cellular routers, and keep vendor accounts disabled until a request is approved.
- Automate enablement: link the approved request to the broker so the account is enabled for the window and disabled at the end without manual steps. A disabled-by-default account is the single control that most reduces standing vendor access.
- Pilot on one site: start with one site and its two or three most frequent vendors, measure friction, then roll out. Keep a phone-and-paper fallback documented for broker outages so staff do not improvise.
- Small and large organisations: a small site can run this as a paper or shared form with a shift lead approving and a recorded broker session. A multi-site operator should run it centrally in the ITSM tool with site-specific approver groups.
- Measure it: percentage of remote sessions with an approved request, vendor accounts enabled outside approved windows, Critical and High sessions reviewed on time, and unmanaged remote access paths found per quarter.
| Form section | Guidance or standard it supports |
|---|---|
| 3.4 Access path and MFA | NERC CIP-005-7 R2 Parts 2.1 to 2.3 (intermediate system, encryption, MFA); NIST SP 800-53 Rev. 5 AC-17 Remote Access; CISA, FBI, EPA and DOE primary mitigations (VPN with phishing-resistant MFA) |
| 3.2 Target assets, 4 Risk tier | CISA primary mitigations: least privilege for the specific asset, user role or scope of work; NIST SP 800-53 Rev. 5 AC-6 |
| 3.4 Monitoring, 5.3 Review | NIST SP 800-53 Rev. 5 AU-14 Session Audit and MA-4 Nonlocal Maintenance; ASD: centralise and monitor remote access logs |
| 3.4 Session restrictions | ASD: disconnect idle jump host sessions after 15 minutes; disable copy and paste and drive redirection |
| 7 System-to-system | NERC CIP-005-7 R2 Parts 2.4 and 2.5 (determine and disable active vendor remote access) |
| Threats addressed | MITRE ATT&CK for ICS T0822 External Remote Services, T0886 Remote Services, T0859 Valid Accounts |
Standards and references
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- Australian Signals Directorate: Remote access to operational technology environments
- NERC: CIP-005-7 Cyber Security, Electronic Security Perimeter(s)
- Texas RE: NERC standards effective and enforcement dates (August 2026)
- NCSC: Secure connectivity principles for operational technology
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- NIST: SP 800-53 Rev. 5
- MITRE ATT&CK: External Remote Services (ICS)
Related NHI Mgmt Group resources: OT Remote Access Guide · Third-Party Access Guide · Identity for OT Environments Guide · Privileged Session Management Guide