Third-Party Remote Access Request Form Template
Machine builders, integrators and ERP consultants need remote access, and attackers know it. This form makes every request name a person, a system, a time window and a control set before the door is opened.
Fill in
Third-Party Remote Access Request Form Template
Remote access request RA-2026-088
Vendor: Northline Automation GmbH Contact: Support engineer, support@vendor.example Internal sponsor: Maintenance Manager Access window: 2026-10-27 to 2026-10-28 Method: Jump host with session recording
Purpose and scope
Purpose: Diagnose spindle fault and update controller parameters under warranty.
Systems and ports: Laser cutter controller, host 10.20.5.14, TCP 3389 only
Conditions of access
| Condition | Confirmed (Yes / No) | Note |
|---|---|---|
| Individual named account, no shared logins | ||
| Multifactor authentication enforced | ||
| Access enabled only for the window above | ||
| Sessions logged or recorded | ||
| Internal staff member present or on call | ||
| Confidentiality agreement or contract clause in force | ||
| Configuration backup taken before work | ||
| Access disabled and confirmed after work |
Approvals
A starting point for your own vendor access procedure. Have legal review any contract terms. Standing access should be the exception, not the rule.
Review your vendor access paths
Optional review of how suppliers and integrators reach ERP, MES and machines.
Optional. The tool and every export work without this. No spam.
How to use the form
The internal sponsor completes the request with the vendor, exports it to PDF or Word, and sends it for approval. Security enables access only after signatures, and disables it after the window closes. File the form with the firewall change record so activity can be traced later.
- One request per task or window
- Prefer a jump host over a direct VPN into the plant
- Require MFA for every vendor identity
- Review all standing vendor accounts quarterly
Why this matters
Third-party access is a common entry route in industrial incidents because vendor credentials are shared, always on and poorly monitored. Frameworks such as NIST SP 800-171, IEC 62443 and many customer security clauses expect scoped, monitored and time limited remote access.
Choosing the access method
Session recorded jump hosts give the best visibility. A supervised screen share is acceptable for low risk tasks. Direct VPN into the production network is the weakest option, and should be limited to specific hosts and ports with no lateral movement.
Common mistakes
Leaving accounts active after the job, allowing broad subnet access when one host is needed, using a shared vendor login, and failing to record what was changed on the machine.
Frequently Asked Questions
Should vendor access be permanent?
Avoid it. Enable access per task with an end date. If standing access is unavoidable, restrict it to specific hosts, require MFA, log all sessions and review it every quarter.
Do we need MFA for vendors?
Yes. Stolen vendor credentials are a common cause of intrusions. If a legacy tool cannot support MFA, put it behind a jump host that does and note it on the form.
Who supervises the session?
A named internal person, usually the maintenance or controls engineer who sponsored it, who can stop the session. High risk work should also have session recording reviewed afterward.
What if the machine is under warranty?
Warranty terms may require remote diagnostics. Meet them by using a controlled method, a restricted window and a documented scope, rather than granting open access.
If you want vendor access sessions logged against ERP and maintenance work orders, we can discuss it. The form works without us.
Related Tools
OT Network Change Request Form Template
A change request form for firewall rules, switch configs and new devices on the plant network, with risk, rollback and production safety approval.
Compliance & ContractsUser Access Review Worksheet for ERP and OT Accounts
List accounts by system and role, flag stale or shared ones and record the keep, change or remove decision.
Compliance & ContractsCyber Security Exception and Risk Acceptance Form Template
Record a policy exception for an unpatchable machine, legacy OS or vendor limitation, with compensating controls, expiry and executive acceptance.
Compliance & ContractsCyber Risk Register Worksheet for Manufacturers
Score IT and OT cyber risks by likelihood and impact, compare inherent and residual risk and track the treatment owner.
More Compliance & Contracts tools
See all- Used Machinery Bill of Sale Template
- Late Delivery Liquidated Damages Notice Template
- Customer Order Cancellation and Restocking Fee Notice Template
- Contract Termination for Convenience Notice Template
- Equipment Factory Acceptance Certificate Template
- Contract Redline Issue Log Worksheet
- Contract Renewal and Notice Deadline Tracker Worksheet
- Late Delivery Liquidated Damages Calculator
- Late Delivery Liquidated Damages Exposure Calculator
Keep exploring
Free tools
- OT Vendor Remote Access Hardening ChecklistA checklist of controls for machine builders, integrators and ERP partners who connect to your plant, grouped by identity, path, monitoring and lifecycle.
- SyteLine User Access Request Form TemplateA fill-in access request and approval form for new, changed and terminated SyteLine users, with a segregation of duties review block.
- AI Agent ERP Access Request Form TemplateA fill-in form that records which ERP roles, objects and limits an AI agent service account needs, with approval signatures.
Guides
- Third-Party Risk Management for ERP Vendors and PartnersThird-party risk management for ERP vendors: assess hosting partners and consultants, read SOC 2 reports, control remote access, and write contract clauses.
- Citrix and Remote Desktop Deployment Guide for SyteLineDeploy SyteLine through Citrix Virtual Apps or RDS with session configuration, printing setup, and performance optimization for remote manufacturing users.
- Building Third-Party Integration Connectors for Infor LNBuild and configure third-party integration connectors for Infor LN. ION Connect, middleware patterns, and connector development for CRM, WMS, and e-commerce systems.
Troubleshooting
- How to configure Ollama for remote access, and why you need a reverse proxy in front of itOllama binds to localhost by default. Here is how to enable remote access with OLLAMA_HOST=0.0.0.0 and why it must sit behind an authenticated proxy.
- Why transformers blocks loading with a trust_remote_code error, and what to actually do about ittrust_remote_code=True executes the repo author's Python code in your process. Understand the real risk, then vendor and review the code before using it in regulated environments.