CrunchAtlasGuide
Third-party ICS access. What vendors can reach.
Controls integrators and equipment vendors need remote access to maintain and support operational systems. Operators need to know where that access enters, what it can reach, what happens through it, and what happens if the vendor is compromised.
Read the CISA and FBI guidanceIf you only read one thing.
Six answers every operator needs from third-party access. Review them with operations, controls, IT, or security, the vendor, and leadership.
Access paths
Every third-party path into the control environment is documented.
Reach and privilege
Every path has defined reachable systems and permitted actions.
Evidence
Activity through each path can be reconstructed after the session.
Vendor-held data
You know what operational information the vendor holds and where.
Introduced systems
Vendor-supplied hardware, software, accounts, and paths are inventoried.
Continuity
Critical operations can continue if every vendor connection is disabled.
01 · Control the access path
Control the vendor access path.
Trust in the vendor does not define the security of the connection. Third-party ICS access needs a defined scope, route, access window, and owner. 1
Scope the job
Define the PLC, HMI, engineering workstation, SCADA server, remote site, or supporting system required for the work.
Trace the route
Document whether access enters through a VPN, jump host, remote access appliance, cellular connection, vendor service, or another path.
Limit the window
Define whether access stays continuously available or is enabled only when maintenance and support require it.
Own the change
Document who approves access, who can change it, and who removes it when the work or relationship ends.
02 · Trace the real path
Trace the actual path into the control environment.
"They use the VPN" does not describe the access path. Follow the connection from the vendor entry point through each boundary to the operational systems and privileges it exposes.
- 01 · Origin: vendor or integrator
- Technician, support account, vendor workstation, or vendor-managed service.
- 02 · Entry: remote access point
- VPN, remote access appliance, vendor service, cellular modem, or another inbound path.
- 03 · Boundary: security boundary
- Firewall, jump host, gateway, or the IT and OT boundary that passes the traffic.
- 04 · Destination: control environment
- Engineering workstation, HMI, SCADA server, PLC, RTU, remote site, and supporting systems.
Entry point, destination, privilege, protocol, access window, and evidence.
A login record shows that access occurred. Network evidence shows where the connection went, what communicated, and whether activity stayed inside the expected path.
03 · The dependency
Understand the dependency behind the connection.
Vendor risk extends beyond the remote session. Integrators hold operational information, introduce technology, and become part of how the environment is maintained, recovered, and operated.
What the vendor holds
- Network diagrams and device details
- Configurations and engineering files
- Logs and operational data
- SCADA information
- Credentials or account information
- Support documentation and backups
What the vendor introduced
- Remote access appliances
- Gateways and cellular modems
- Engineering workstations
- Vendor software and services
- External communications paths
- Accounts and update mechanisms
CISA and the FBI cite a 2025 compromise of a U.S. industrial automation company in which actors searched for customer and SCADA information and prepared about 800 files for presumed exfiltration. A compromised vendor can expose operational information before an attacker reaches the operator network. 1
04 · If access disappears
If vendor access vanished tonight, what breaks?
Vendor access should support operations without becoming a single point of operational failure.
- Operate
- Know which operational processes depend on vendor connectivity, accounts, or services.
- Troubleshoot
- Retain the software, documentation, configurations, credentials, and local access required to support critical systems.
- Recover
- Maintain current backups and known-good configurations outside systems that may be affected.
- Operate manually
- Test manual operating procedures under realistic conditions before they become the fallback.
05 · Put it in writing
Put the handoffs in writing.
Contracts and support agreements need to match the operating environment. Remote access, system changes, incident support, data custody, and recovery all need an explicit owner.
- Remote access
- Authorized users, approved systems, approval process, access windows, and termination requirements.
- Operational data
- What can leave the environment, permitted storage, access, retention, and deletion.
- System changes
- Who can change configurations, firmware, software, control logic, and access settings.
- Cyber incidents
- Notification, evidence preservation, investigation support, and escalation responsibilities.
- Recovery
- Configurations, backups, documentation, credentials, and support available if vendor access is unavailable.
For electric utilities, vendor access, software integrity, incident coordination, and evidence also intersect with supply chain risk management requirements.
NERC CIP-013 guideEvery unchecked item needs an owner. "The integrator handles it," "IT owns the VPN" and "we have a firewall" do not establish ownership of the full access path.
Trusted access still needs evidence.
Talk with our team about seeing where a vendor connection went and what happened through it.
06 · Where CrunchAtlas fits
Where CrunchAtlas fits.
Secure remote access controls who is allowed to connect. CrunchAtlas supports the evidence and investigation side: it shows what vendor activity did across monitored IT and OT networks, then carries suspicious behavior into an investigated case.
Coverage depends on deployment scope, available telemetry, and the systems being monitored. Consequential actions remain operator controlled.
Network Detection and Response
Passively surface vendor and third-party activity without actively probing operational systems.
Alert Investigation
Turn unexpected vendor activity into an evidence-backed case with scope, verdict, confidence, and next steps.
Host and Network Forensics
Reconstruct what happened after the vendor session or suspicious activity has ended.
Incident Reporting
Keep affected systems, timeline, evidence, verdict, and actions in one record.
07 · FAQ
Third-party ICS access, answered.
Should integrator remote access stay enabled all the time?
Access should match the operating requirement. If continuous access is not required, define when it is enabled, who approves it, and when it is removed.
Is a VPN enough for vendor access to an ICS or SCADA environment?
A VPN can secure and authenticate the connection, but operators still need to know what it can reach and what happens after the session starts.
Does the controls integrator own cybersecurity for the systems they support?
Only when the scope assigns those responsibilities. Engineering support, remote maintenance, monitoring, backups, investigation, and incident response can be owned by different parties.
What should operators retain from third-party remote access?
Enough evidence to show when the connection occurred, which systems communicated, where the activity went, and whether it stayed inside the expected path.
08 · Sources
Sources.
This guide applies federal and NIST guidance to third-party remote access, integrator relationships, and operational dependencies in ICS and OT environments.
- CISA and FBI, Considerations for Critical Infrastructure Operators Working With Third Party ICS Integrators, September 23, 2026
- Secure Connectivity Principles for Operational Technology, January 14, 2026
- NIST, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Architecture, support agreements, and third-party responsibilities vary by environment. Apply the guidance to the systems and operating requirements actually in scope.
Keep reading.
Know what every vendor can reach.
Talk with our team about seeing where vendor connections go across your IT and OT networks.
Talk to our teamSign up for our newsletter