Before a vendor, integrator or managed service provider connects to your control systems, ask how they connect, with whose credentials, for how long, and with what logging. CISA's guidance recommends least privilege, phishing-resistant multifactor authentication, no persistent vendor connections and regular coordination with providers to find misconfigurations.
Why this list exists
CISA's 2025 mitigations tell owners to coordinate regularly with managed service providers, system integrators and manufacturers to address misconfigurations. The performance goals 2.0 add managed service provider risk as an updated goal area. The 2015 Ukraine alert advises avoiding persistent vendor connections into control networks.
Put those together and you get a short procurement checklist.
Twelve questions
Connection
- How do your staff connect to our systems: VPN, jump host, remote control software, or a link you maintain?
- Is any connection always on? If yes, why?
- Can we switch access on only when a ticket exists, and off afterward?
Identity
- Does each person have an individual account, with no sharing?
- What multifactor method do you use, and is it phishing resistant?
- What happens to access when one of your employees leaves?
Privilege and logging
- What is the least access you need for this job?
- Can sessions be recorded or logged, and who can see the logs?
- Do you store our credentials or configuration, and where?
Product and support
- Do your products ship without default passwords and let us keep admin interfaces off the internet? The 2023 PLC advisory asks manufacturers for exactly this.
- How do you tell us about vulnerabilities and updates for products we run?
- Will you contractually notify us of an incident that could touch our systems, and how fast?
What good answers sound like
Good answers are specific. They name the tool, the control and the owner. They offer to show you a session log. They accept time limits without argument.
Weak answers sound like "we have always done it this way," or "it is the vendor's standard setup." Treat vague answers as a finding, and note them in your risk register.
Put it in the contract
Write the key points into the agreement: individual accounts, multifactor authentication, time-limited access, logging, incident notification and the right to audit. Review the access list at renewal.
Quick check
Can we ban remote access altogether?
Some sites can. Others rely on vendors for support. If access is needed, make it controlled, time-limited and logged.
Does this apply to cloud tools too?
Yes. Any provider that can reach your systems, including software services, deserves the same questions.
For the software side of vendor risk, Safeguard offers SBOM and dependency scanning and compliance evidence automation, which help you check what a supplier ships. It does not manage OT remote access.
Sources
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, Cross-Sector Cybersecurity Performance Goals
- CISA, IR-ALERT-H-16-056-01
- CISA et al., AA23-335A
Last reviewed: 19 October 2026.
