Most OT sites control the sessions a vendor opens into the plant, but very few check how that vendor protects the people, laptops, accounts and tools on its own side of the connection. An integrator or original equipment manufacturer (OEM) with remote access to your controllers is, in practice, an extension of your control room: a compromised engineer laptop, a shared support login or an unmanaged remote support tool at the supplier becomes a path into your OT zones. This template is a supplier-level assessment, run before remote access is granted and again at renewal, that asks the supplier how it secures its side of the connection, what evidence it can show, and what it commits to in the contract. It is for OT security leads, procurement and supplier managers, and site engineering managers. The per-session form is the OT Remote Access Request Form Template, the architecture is in the OT Remote Access Guide, and this page does not repeat either.
How to use this template
- When to run it: before any new supplier is given a remote access account, when a supplier's scope widens to new sites or safety systems, at contract renewal, and after any incident involving the supplier. Section 7 sets the cadence by tier.
- How to run it: send sections 3 and 4 to the supplier as a questionnaire, ask for the evidence listed against each question, then score answers in section 5. A self-attested "yes" with no evidence scores as partial at best.
- Placeholders: replace text in square brackets, such as [Organisation], [OT security lead] and [24 hours], with your own roles and values. Values in brackets are NHI Mgmt Group suggestions; set them against your safety case, sector regulation and contract terms.
- Scope boundary: this template assesses the supplier. Your own broker, jump hosts and approval workflow are measured in the OT remote access and historian health check, and the platform itself is covered in Securing the OT remote access platform itself.
- Regulated entities: North American electricity entities subject to NERC CIP-013-2 must have procurement processes that address coordination of controls for vendor-initiated remote access (Requirement R1 Part 1.2.6). Section 4 questions can serve as evidence of that process. NERC lists CIP-013-3 and CIP-005-8 with an enforcement date of 1 July 2028, so confirm which versions apply to you.
1. Purpose
This assessment establishes whether [Supplier] can connect remotely to [Organisation]'s operational technology at [Site(s)] without adding unacceptable risk to safety, availability or security. It records how the supplier controls its own staff, devices, accounts, tools and subcontractors; the evidence provided; the residual risk; and the conditions attached to approval. No supplier remote access account is created or renewed without a current, approved assessment at the tier set in section 2.
2. Scope and supplier tiering
Every external party that connects, or could connect, to OT assets is in scope: OEMs, system integrators, maintenance contractors, managed service providers, remote monitoring and analytics services, and the supplier of the remote access platform itself. Tier each supplier before sending the questionnaire, because the tier sets how deep the assessment goes.
| Tier | Triggers (any one) | Assessment depth | Approver |
|---|---|---|---|
| Critical | Access to safety instrumented systems (SIS); ability to change logic, setpoints or firmware; persistent system-to-system connection into Levels 0 to 2; supplier of the remote access platform | All sections, evidence for every question, interview with the supplier's security owner, annual reassessment | Asset owner, [OT security lead], process safety and [CISO] |
| High | Interactive access to engineering workstations, HMIs or controllers; file transfer into OT; multiple sites | All sections, evidence for every question marked E | Asset owner and [OT security lead] |
| Medium | Read-only diagnostics or data retrieval from a single site | Sections 3.1 to 3.5 and 4, evidence for questions marked E | Asset owner and [OT security lead] |
| Low | Access to historian replicas or reporting data in the industrial DMZ only | Sections 3.1, 3.2 and 4 | [OT security lead] |
3. Supplier security questions
E marks questions where evidence is required for High and Critical suppliers. Ask the supplier to answer in its own words and attach the evidence; avoid yes or no boxes.
3.1 People and accountability
| Ref | Question | Evidence to request |
|---|---|---|
| P1 | Who is your named security contact for this service, and who can authorise or stop your engineers' access out of hours? | Name, role, 24x7 contact route |
| P2 (E) | Which named individuals will connect to our OT systems? How do you vet them and train them on OT safety and security? | Named list, training records, screening policy |
| P3 (E) | How quickly do you tell us when one of those individuals leaves, changes role or should no longer have access? | Leaver procedure and the contractual notice period, for example [24 hours] |
| P4 | Do you use subcontractors or offshore support teams for this service? Which ones, from where, and do they connect? | Subcontractor list with locations and roles |
3.2 Accounts and authentication
| Ref | Question | Evidence to request |
|---|---|---|
| A1 (E) | Will every engineer use an individual named account on our broker, with no shared team or generic logins? | Statement of practice; list of accounts requested |
| A2 (E) | Which multi-factor authentication methods do your engineers use, and are they phishing-resistant (FIDO2 security keys, platform authenticators or smart cards)? | MFA policy, enrolment records for named staff |
| A3 (E) | Where do you store any credentials for our devices or systems, who can read them, and how are they rotated when staff leave? | Vault or password manager description, access list, rotation records |
| A4 | Do your products or services rely on default, hard-coded or shared vendor passwords, and how do you help us change them? | Product hardening guide, credential change procedure |
| A5 | Do any of your service accounts, API keys or certificates connect system-to-system into our OT environment? Who owns them and how often are they rotated? | Inventory of machine credentials with owner and rotation date |
Question A5 matters because system-to-system links are often missed: NERC CIP-005-7 Requirement R2 Parts 2.4 and 2.5 expect entities to be able to determine and disable active vendor remote access for both interactive and system-to-system access. For governing those machine credentials, see the Identity for OT Environments Guide.
3.3 Endpoints used to connect
| Ref | Question | Evidence to request |
|---|---|---|
| D1 (E) | Do engineers connect only from company-managed devices? Are personal devices ever used? | Device policy, asset register extract for named engineers |
| D2 (E) | How are those devices hardened: endpoint protection, disk encryption, patching, local administrator control, application control? | Hardening standard, compliance report from device management |
| D3 | Are devices that connect to customer OT kept separate from general web browsing and email, for example a dedicated support laptop or virtual desktop? | Architecture description |
| D4 | Is VPN split tunnelling disabled while connected to customer environments? | Configuration statement |
D3 and D4 follow the Australian Signals Directorate's advice on remote access to OT, which recommends organisation-supplied devices, avoiding web browsing on devices that access the OT environment, and disabling split tunnelling.
3.4 Remote access tools and connection method
| Ref | Question | Evidence to request |
|---|---|---|
| T1 (E) | Will you connect only through our approved broker? List every remote access product, modem, cellular router or cloud service you install or rely on at our sites today. | Full list per site, including equipment shipped with your products |
| T2 (E) | Does any of your equipment open inbound connections, or connect out to your cloud without our broker? | Network flow description and ports |
| T3 | If you provide connectivity, which public IP addresses will your endpoints use, and will you tell us when they change? | IP list and change notification commitment |
| T4 | How do you transfer files, patches and firmware to our sites, and how do you check them for malware and authenticity first? | Transfer procedure, hash or signature verification method |
The NCSC-led Secure connectivity principles for OT say external parties such as remote vendor support should use brokered connections through a secure gateway in a separate, security-controlled segment, and that where a third party provides connectivity you should consider its endpoints in your exposure management and agree how it shares endpoint IP addresses. T1 to T3 test both points. CISA's guide to securing remote access software notes that threat actors increasingly co-opt legitimate remote access tools, which is why T1 asks for a complete inventory rather than the approved tool alone.
3.5 Monitoring, incidents and vulnerabilities
| Ref | Question | Evidence to request |
|---|---|---|
| M1 (E) | How do you log and monitor your engineers' remote access to customers, and how long do you keep those logs? | Logging standard, retention period, example report |
| M2 (E) | How quickly will you notify us of a security incident at your company that could affect our systems, credentials or data? | Incident notification clause and contact route, for example [24 hours] |
| M3 | How will you coordinate response with us if your support environment is compromised, including cutting your access? | Incident response plan extract |
| M4 (E) | How do you disclose vulnerabilities in the products and software you supply, and do you publish security advisories? | Vulnerability disclosure policy, advisory page link |
| M5 | Do you hold an independent assessment of your support organisation, such as IEC 62443-2-4 certification, ISO/IEC 27001 certification covering this service, or a recent third-party audit? | Certificate with scope, or audit summary |
M2 to M4 mirror CIP-013-2 Requirement R1 Part 1.2: vendor notification of vendor-identified incidents, coordination of responses, notification when remote or onsite access should no longer be granted, and disclosure of known vulnerabilities. IEC 62443-2-4 sets security programme requirements for IACS service providers, so it is the natural certification to ask an integrator about; check the certificate's scope covers the team that will connect.
4. Contract and onboarding commitments
Ask the supplier to accept each commitment, or to propose an alternative, before access is granted. NIST CSF 2.0 GV.SC-05 expects supply chain security requirements to be integrated into contracts.
- All remote access to [Organisation] OT uses [approved broker] with named accounts and phishing-resistant MFA; no other remote access tools, modems or cellular devices are installed without written approval.
- The supplier notifies [OT security lead] within [24 hours] when a named engineer leaves or no longer needs access.
- The supplier notifies [Organisation] within [24 hours] of a security incident that could affect [Organisation]'s systems or credentials, and supports joint response.
- Software, patches and firmware are supplied with a means to verify integrity and authenticity (CIP-013-2 Part 1.2.5).
- Vulnerabilities in supplied products are disclosed with remediation or mitigation advice.
- Sessions may be recorded and live-monitored, and [Organisation] may terminate any session at any time.
- Subcontractors who connect are named in advance and bound by the same terms.
- The supplier supports reassessment at the cadence in section 7 and provides evidence on request.
5. Scoring and decision
| Score | Meaning |
|---|---|
| 2 Met | Practice in place and evidence provided that covers the people and service in scope |
| 1 Partial | Practice described but evidence missing, out of date or narrower than the service |
| 0 Not met | Practice absent, refused or contradicted by evidence |
- Must-pass questions: A1, A2, D1, T1 and T2 for High and Critical suppliers. A score of 0 on any must-pass question means no access until fixed or a time-bound exception is approved.
- Approve: all must-pass questions at 2 and no more than [3] questions at 0.
- Approve with conditions: must-pass met, other gaps covered by compensating controls on your side, such as live-watched sessions only, credential injection so the vendor never sees passwords, or access only during staffed shifts. Record each condition with an owner and date.
- Reject or defer: any must-pass question at 0 without an approved exception.
6. Assessment record
| Field | Entry |
|---|---|
| Supplier and contract reference | [Supplier], [contract number] |
| Sites and assets in scope | [Sites, zones, asset classes] |
| Tier | [Critical, High, Medium, Low] |
| Scores and gaps | [Per section totals, list of 0 and 1 answers] |
| Conditions and compensating controls | [Condition, owner, due date] |
| Decision and approvers | [Approve, approve with conditions, reject], names and date |
| Next reassessment | [Date] |
7. Reassessment and triggers
- Cadence: Critical annually; High every [2 years]; Medium and Low at contract renewal.
- Triggers for an early reassessment: a security incident at the supplier, a change of ownership or support location, new sites or safety systems in scope, a new remote access product, or a session finding from your monitoring.
- Offboarding: at contract end, disable broker accounts, rotate any device credentials the supplier knew, remove supplier equipment and connectivity, and record the closure.
Implementation guidance
- Build the supplier list first. Use broker accounts, firewall rules, passive monitoring and purchase orders to list every party with OT remote access, then tier them. Unknown connections found here go to the OT security lead before any questionnaire is sent.
- Pilot with two or three Critical suppliers. Walk through the questions with their security owner, adjust wording that confuses OT engineers, and agree what evidence is realistic.
- Link the outcome to access. Make an approved assessment a precondition for creating a broker account, so the request form in the OT Remote Access Request Form Template cannot be raised for an unassessed supplier.
- Roll out by tier. Critical and High within [6 months]; Medium and Low at renewal. Where a key supplier cannot meet a must-pass question quickly, approve a time-bound exception with compensating controls rather than cutting off support for running plant.
- Feed monitoring back. Session recordings, broker logs and walkdown findings should update the supplier's score between assessments.
Small and large organisations: a single-site operator with a handful of suppliers can run this as a spreadsheet owned by the site engineering manager, focusing on must-pass questions. Multi-site operators should hold assessments centrally in the third-party risk platform, assess each supplier once per service, and record site-specific conditions locally. The Third-Party Risk Management Guide covers the wider programme.
Measuring it
- Percentage of suppliers with OT remote access holding a current, approved assessment (target 100%).
- Number of open conditions past due date.
- Median days from a supplier leaver to account disablement, compared with the contract notice period.
- Remote access tools or connectivity found at sites that a supplier did not declare under T1.
Common failure patterns
- Generic IT questionnaires: asking about data centres and data privacy, but never about the engineer laptop, the support tool or the modem shipped inside a control panel.
- Accepting attestation as evidence: "all staff use MFA" without enrolment records for the named engineers.
- Forgetting system-to-system links: remote monitoring and analytics feeds run on supplier-held keys that nobody rotates.
- No leaver notice: the supplier's engineer leaves, but the broker account stays enabled because nobody at the supplier tells you.
- Assessing once: support moves to a new region or subcontractor and the original assessment no longer describes who connects.
Framework mapping
| Template section | Framework reference |
|---|---|
| 2 Tiering, 5 Decision | NIST CSF 2.0 GV.SC-06 (due diligence before relationships), GV.SC-07 (supplier risks assessed and monitored); NIST SP 800-53 Rev. 5 SR-6 Supplier Assessments and Reviews |
| 3.2 Accounts and authentication | NIST SP 800-53 Rev. 5 AC-2, IA-2, MA-4 Nonlocal Maintenance; NERC CIP-005-7 R2 Part 2.3 (MFA for Interactive Remote Access) |
| 3.4 Tools and connection method | NIST SP 800-53 Rev. 5 AC-17 Remote Access; NCSC-led secure connectivity principle 2; NERC CIP-005-7 R2 Part 2.1 (Intermediate System) |
| 3.5 Incidents and vulnerabilities | NERC CIP-013-2 R1 Parts 1.2.1 to 1.2.4; IEC 62443-2-4 |
| 4 Contract commitments | NIST CSF 2.0 GV.SC-05; NIST SP 800-53 Rev. 5 SA-9 External System Services, SR-3 |
| Threats addressed | MITRE ATT&CK for ICS T0822 External Remote Services, T0886 Remote Services, T0859 Valid Accounts |
Standards and references
- NERC: CIP-013-2 Cyber Security, Supply Chain Risk Management
- NERC: CIP-005-7 Cyber Security, Electronic Security Perimeter(s)
- NCSC: Secure connectivity principles for operational technology
- Australian Signals Directorate: Remote access to operational technology environments
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA: Guide to Securing Remote Access Software
- ISA: ISA/IEC 62443 Series of Standards
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: OT Remote Access Guide · Third-Party Access Guide · Supplier Security Policy Template · IEC 62443 Guide · NERC CIP-013