Before you buy or connect OT equipment, ask whether it ships without default passwords, whether administrative interfaces are exposed to the internet, how remote support works, how fixes are delivered and for how long, and what the integrator can access after handover. These questions come straight from agency guidance.
Product questions
Default credentials. CISA's Unitronics advisory urges manufacturers to ship products without default passwords. Ask whether the product forces a unique credential at first use.
Exposed interfaces. The same advisory says to avoid exposing administrative interfaces to the internet. Ask which services listen by default and which can be turned off.
Authentication on protocols. AA22-103A advises configuring OPC UA application authentication with explicit trust lists. Ask which protocols the product uses, what security features each offers, and whether they are on by default.
Firmware integrity. Ask how you can verify firmware and configuration files, since agencies recommend hashing and integrity checks.
Backup and restore. Ask how logic and configuration are exported and restored.
Vulnerability handling. Ask how the supplier receives reports, how quickly it responds and how it publishes advisories. For EU sales, the Cyber Resilience Act sets reporting duties and a stated support period, so ask for the end date.
Standards. If a supplier cites ISA/IEC 62443, ask which parts, which edition and who assessed it.
Integrator and service provider questions
CISA's Siemens S7 alert urges owners to share guidance with integrators and managed service providers who have remote access. Ask:
- What remote access will you need, and how will it be secured with MFA and named accounts?
- Will any connection stay open permanently? CISA advises against persistent vendor connections.
- Which accounts and credentials will you hold after commissioning, and how do we revoke them?
- Will you hand over a current inventory, network diagram and backups?
- Which of your staff can touch our systems, and how do you notify us of changes?
- How will you report a security incident to us, and in what timeframe?
Put answers in the contract
Convert the answers into terms: no default credentials at delivery, documented ports and services, handover of backups, named access with MFA, incident notification, and a patch commitment. Verify at acceptance testing, not only on paper.
Score the answers
A simple three level score per question, met, partly met, not met, lets you compare bids. Treat any refusal to answer as a finding.
Where Safeguard fits
For software that comes with a purchase, such as dashboards or integration code, Safeguard can scan dependencies and produce an SBOM. A free scan is at https://gold.safeguard.sh/scan. It does not assess controller firmware.
Quick check
Is a supplier's IEC 62443 mention enough?
No. Ask which parts and edition, what was assessed, and by whom.
Should integrators keep remote access after handover?
Only if needed and agreed, with named accounts, MFA, time limits and logging. Otherwise revoke it.
Sources
- CISA, IRGC-Affiliated Cyber Actors Exploit PLCs, AA23-335A
- CISA, APT Cyber Tools Targeting ICS/SCADA Devices, AA22-103A
- CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
- CISA, Ukraine Power Grid Cyber-Attack alert
- European Commission, Cyber Resilience Act summary
- ISA, ISA/IEC 62443 Series of Standards
Last reviewed: 19 October 2026.
