Integrators and vendors want persistent VPN access for convenience. Plants want support without exposing every PLC to the internet. The compromise is time-bound access, least privilege, and logging—not a shared password in a drawer.
Access models we recommend
- Jump host with session recording and approval workflow per incident.
- Read-only historian access by default; write access requires maintenance lead approval.
- Automatic expiry after ticket closure; no standing vendor accounts.
- Separate paths for IT systems and OT subnets—no flat VPN.
Cyber hygiene ties to operations
Remote support during a jam is useless if firewall change windows block the session. Pre-authorise support paths in calm periods and test them quarterly. Pair with OT cyber hygiene basics: patching where safe, asset inventory, and incident contacts on the wall.
Summary
Boundaries protect production integrity and vendor liability alike. Document who can do what, for how long, and under whose approval—before the night shift calls for help.