Monitoring the Extended Perimeter: The CFC and OT Vendor Access
How the CFC turns third-party OT access from blind trust into governed, monitored and revocable infrastructure
The average industrial organization gives 77 third-party vendors access to its OT environment. One in four gives that access to more than 100 vendors. Those numbers come from the Ponemon Institute's 2024 study of OT access risk, and the Tosi 2026 State of OT Security Report concentrated the industry's weakest area in the same place: how vendors and employees access OT systems remotely.
This is not a procurement failure. It is the operational reality of running a modern industrial environment. Vendor access is not going away. What is going away is the assumption that it can be left ungoverned.
The Gap Between What Exists and What Gets Watched
The SANS 2025 State of ICS/OT Cybersecurity Survey produced one of the sharpest data points in this discussion: half of OT incidents reported in 2025 began with unauthorized external access, and fewer than 15% of organizations have advanced remote access controls in place. Only 13% have fully implemented session recording, real-time session approvals or ICS-aware access enforcement. About 31% do not keep a centralized inventory of ICS/OT remote access points.
The first honest mapping in a CFC engagement almost always finds more than expected. Claroty's 2024 study of more than 50,000 OT-connected devices across 120 companies reported 55% of those devices used four or more remote access tools to reach the outside world, and nearly 80% had more than two non-enterprise-grade tools deployed.
Tools like TeamViewer, AnyDesk and consumer-grade RDP were not built for industrial environments, yet they keep appearing in critical infrastructure. The Oldsmar, Florida water treatment incident in February 2021 remains a canonical example. An attacker used TeamViewer to attempt to raise sodium hydroxide levels in the city's water supply. The tool was not malicious. The architecture around it was missing.
Where the Standards Converge on Vendor Access
Every major framework governing OT access describes the same architecture in different language. NIST SP 800-82 Revision 3, IEC 62443 foundational requirements, the EU's NIS2 Directive, TSA Security Directive 02E for U.S. pipelines and NERC CIP-013 converge on six requirements: identity-based authentication with MFA, brokered access through a defined conduit or jump server, time-limited and explicitly approved sessions, recorded audit trails, real-time termination capability and application-level scoping instead of broad network-level membership.
The CFC builds that pattern as connected infrastructure, not as disconnected tooling. Purpose-built OT secure remote access platforms such as Cyolo, Claroty xDome Secure Access, Xage Security, Xona Systems and Dispel are designed for environments where legacy protocols, agentless deployment and availability constraints make IT-grade PAM insufficient on its own.
Jump server architecture in an industrial DMZ brokers every external connection through one audited choke point with no direct vendor-to-OT path. Modern implementations spin up isolated per-session jump boxes that self-destruct when sessions end. This eliminates standing credentials and blocks lateral movement between vendor sessions.
Credential vaulting and credential injection keep vendors from seeing the underlying asset credentials. MFA is enforced at access entry, not treated as optional. NIS2 Article 21(2)(j) made MFA a regulatory requirement for EU critical infrastructure operators as of October 2024, with penalties up to 2% of global turnover. NERC CIP-013, IEC 62443 and TSA 02E converge on the same operational outcome through different control models.
Approving, Watching and Revoking Vendor Sessions
What separates a working vendor access program from a vendor access policy is workflow: request, review, approve, monitor and revoke.
Just-in-time provisioning grants a vendor only the privileges needed for a specific task, on a specific asset, for a defined time window, then revokes those privileges automatically when work ends. That replaces persistent always-on VPN tunnels and unmonitored RDP sessions with discrete sessions approved by operations.
For routine OEM diagnostics, automated rules reduce bottlenecks. For higher-risk work, four-eyes workflows require both cybersecurity and operations approval before a session starts. Break-glass procedures handle legitimate emergencies without forcing unsafe workarounds.
Session recording captures visual output, command activity, configuration changes, accessed assets and time-stamped identity attribution, with storage in write-protected segments vendors cannot access. NIS2 audit guidance and many cyber insurance requirements push toward at least a 12-month retention window for OT session recordings. IEC 62443 does not mandate retention duration, but it does require a human-readable record of performed actions, which VPN tunnels alone do not produce.
The behavioral layer runs above recording. Recording proves what happened. It does not determine whether behavior matched approved work intent. Dragos, Nozomi and Claroty parse industrial protocol behavior and baseline normal vendor activity per asset type, then alert when commands fall outside expected sets, access reaches out-of-scope assets, transfer volumes exceed thresholds or traffic patterns deviate from learned norms. As Darktrace's 2025 analysis framed it, access without detection leaves a gap, and detection without access control leaves an incomplete picture. The CFC builds both layers because both standards and threat data require both layers.
When Vendor Access Becomes the Threat Vector
Vendor-origin incidents move differently from internally originated events. Evidence and control are split across organizations. Containment has to preserve continuity because the same vendor pathway that became hostile may still support active production. Communication often shifts out-of-band because vendor email and ticketing systems may be compromised.
The CFC incident response procedure begins with a vendor kill switch: a pre-built capability to revoke every active path from one vendor in one action, including session termination, credential disablement, API key revocation and OAuth grant teardown.
Session recordings preserved before incident onset shorten scoping from days to hours because what a vendor did in the previous 90 days becomes a query rather than a reconstruction exercise. Pre-negotiated communication channels, contractual notification SLAs and vendor-specific playbooks for critical relationships turn improvisation into procedure.
The cost case remains direct. The Change Healthcare incident in 2024 produced more than $1 billion in losses and traced to a remote server lacking MFA. Ponemon's 2025 research puts average supply chain breach cost at $4.91 million and 267 days to identify and contain. Gartner's analysis adds that third-party breaches cost roughly 40% more than internally originated events. Verizon's 2025 Data Breach Investigations Report shows the share of breaches involving a third party doubling year over year from 15% to 30%.
Where This Sits in the CFC Architecture
Vendor access governance is not a bolt-on control. Building Around What Won't Change established how the CFC applies compensating controls around legacy OT systems, and vendor access retrofit is one of those foundational wraps because legacy equipment concentrates vendor maintenance dependency. The CFC as OT Visibility Architecture, published earlier in this series, showed how vendor session telemetry feeds the same IT-OT SOC and SIEM workflows consuming broader OT telemetry.
The companion vCISO layer, Owning the Vendor Risk, addresses governance and contractual control. The Third-Party Shadow Current traces how attackers traverse vendor pathways when these controls are absent. Each reinforces the same architecture from different operational angles.
This article closes the architectural phase of the CFC series. Visibility, legacy compensating controls and vendor access governance together create a foundation that can be operated against, not merely documented.
What Comes Next: The next article examines the compliance trap: when organizations treat compliance as the goal instead of the baseline.
Learn more about the OT vCISO role in this executive brief: The Missing Leadership Layer in Industrial Cybersecurity.
Vendor access is operationally required.
Blind vendor access is operationally reckless.
The CFC closes the gap between access and control.
Sprawl creates hidden pathways. Without centralized inventory and brokered access, teams cannot confidently answer who can reach which OT asset right now.
Identity, MFA, brokered conduits, explicit approvals, full audit trails and revocable sessions are no longer optional architecture choices.
JIT access, four-eyes approval and credential injection remove standing trust and reduce blast radius when a vendor endpoint is compromised.
Access control without protocol-aware detection leaves blind spots. Detection without session governance leaves unmanaged pathways.
When vendor pathways are managed as infrastructure, scoping shifts from forensic guesswork to query-based evidence and faster containment decisions.
NIST SP 800-82 Rev. 3, IEC 62443, NIS2, TSA 02E and NERC CIP-013 each frame OT vendor access as controlled infrastructure, not ad hoc exception handling.
The language differs by framework, but practical outcomes are aligned: identity verification, MFA, approved session windows, audited trails and revocable access pathways.
Control flow runs as a repeatable loop: request, review, approve, monitor and revoke. Session boundaries, not network membership, become the enforcement unit.
This keeps maintenance work operationally feasible while limiting lateral movement and reducing standing privilege accumulation.
Vendor-origin incident response requires pre-negotiated communications, immediate cross-system revocation capability and searchable historical session records.
Without this pattern, containment drifts into coordination delays and evidence gaps at exactly the moment speed matters most.
OT vendor access is unavoidable in modern industrial operations. Governance is the differentiator between operational dependency and attack surface exposure.
The strongest programs combine session control and OT-aware behavioral detection, because each layer is incomplete without the other.
The CFC positions vendor access as managed infrastructure: identity-bound, approved, monitored, recorded and revocable on demand.