# OT Vendor Remote Access Hardening Checklist > Source: https://netray.co/tools/ot-vendor-remote-access-hardening-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A checklist of controls for machine builders, integrators and ERP partners who connect to your plant, grouped by identity, path, monitoring and lifecycle. ## Category compliance-legal ## Industry Manufacturing ## Audience - IT security lead - OT engineer - Plant manager ## Tool **Kind:** checklist **Groups:** #### Identity and approval **Items:** **Text:** Every vendor user has a named individual account, never a shared login **Critical:** true **Text:** Multi-factor authentication is enforced on every remote path **Critical:** true **Text:** Access is approved per request with a stated purpose, system and end time **Critical:** true A named internal owner is accountable for each vendor relationship Vendor staff changes trigger notification so accounts can be removed Accounts are disabled by default and enabled only for approved windows Contract includes security obligations and breach notification terms #### Network path **Items:** **Text:** All access goes through a hardened jump host or remote access gateway **Critical:** true **Text:** Direct inbound RDP, VNC or SSH from the internet to plant systems is blocked **Critical:** true **Text:** Cellular routers and vendor-supplied modems on machines are inventoried and controlled **Critical:** true The gateway sits in a DMZ with rules limiting reachable systems to the approved list Vendor sessions can reach only the systems named in the request Outbound connections from plant zones to vendor clouds are allow listed Split tunneling is disabled on any VPN used for vendor access #### Session control and monitoring **Items:** **Text:** Sessions are logged with user, source, target and duration **Critical:** true Privileged sessions are recorded or observable in real time File transfer in and out of the jump host is controlled and scanned **Text:** Plant staff can end a session immediately and know how **Critical:** true Alerts fire on access outside the approved window Idle sessions time out automatically Logs are forwarded off the gateway to a central collector Software and firmware changes by vendors are recorded in a change log #### Endpoint and data hygiene **Items:** Vendor laptops meet a stated minimum for patches and endpoint protection **Text:** Vendor-supplied USB media and laptops are scanned before connecting to plant networks **Critical:** true Backups of PLC, CNC and HMI programs are taken before vendor changes Credentials for equipment are held in a vault and rotated after vendor work Default passwords on vendor-installed devices are changed at handover Remote support tools installed by vendors are approved and listed #### Lifecycle and review **Items:** **Text:** All active vendor accounts are reviewed at least quarterly **Critical:** true **Text:** Accounts and tunnels are removed at project close or contract end **Critical:** true Vendor access appears in the incident response plan with contacts A test of the kill switch for vendor access is done at least yearly Vendors notify you of compromises in their own environment Findings from the review feed the risk register with owners and dates **Scoring Note:** Aim for every critical item complete. Any critical item unchecked is a gap to log in your risk register with an owner and date. ## Content **Intro:** Machine builders, integrators and ERP partners often need remote access, and it is one of the most common ways into plant networks. This checklist lays out the controls that make that access approved, narrow, watched and temporary. **Sections:** #### How to use it **Body:** Go through the list once per vendor or once for your overall remote access service. Tick what is in place today and mark gaps. Critical items are the ones that, if missing, create a direct path from the internet or a vendor to your controllers. Export the completed list as evidence for an audit, an insurer questionnaire or a customer assessment. **Bullets:** - Do one pass per vendor for high-risk machines - Treat unchecked critical items as open risks - Repeat after any change of vendor or tool #### Why vendors are a priority **Body:** A vendor account usually has more access than a staff account, is used from networks you do not control, and is rarely reviewed. Compromises at service providers have repeatedly led to downstream intrusions. Reducing blast radius with a single gateway, per-request approval and a hard time limit addresses most of that exposure. #### Jump host design **Body:** A good gateway authenticates with MFA, authorizes against a list of approved targets, records the session and holds credentials the vendor never sees. It lives in a DMZ, not on the plant network, and is patched like a perimeter device. Vendor tools that install their own tunnel on a machine bypass all of this and must be found and removed or controlled. #### Common mistakes **Body:** The usual failures are shared vendor logins that never change, a cellular router on a machine that someone installed for a service visit, and accounts left active years after a project ended. Another is an approval process so slow that vendors work around it. Make the sanctioned path the easy one. **Cta:** If you want a vendor access request flow tied to your ERP or ticketing system with expiry built in, Netray can help design it. **Faq:** #### Is a VPN enough for vendor access? **Answer:** Rarely. A VPN gives network reach. You also need MFA, per-system authorization, session logging and a time limit. Without those, a stolen VPN credential becomes full access to whatever the tunnel can reach. #### How do I handle machine builders with built-in remote support? **Answer:** Inventory every such connection, route it through your gateway where the vendor allows, and keep it disabled until needed. Where it cannot be controlled, isolate the machine in its own zone. #### How often should access be reviewed? **Answer:** At least quarterly for active vendor accounts, plus at project close. Link the review to a calendar owner so it does not depend on memory. #### What should contracts say? **Answer:** Require MFA, named accounts, patched endpoints, breach notification within a set period, and cooperation in investigations. Have legal review the wording, as this checklist is operational guidance, not legal advice. ## Search terms vendor remote access security checklist, ot remote access best practices, third party remote access plant, jump host for vendor access, machine builder remote support security, remote access mfa ot, vendor access offboarding checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json