By
Daniel Mercer
President, Council on Critical Infrastructure
March 17, 2026
Among the most significant and most undermanaged risks in industrial cybersecurity is the access granted to third parties. Vendors, system integrators, maintenance contractors, and remote support providers routinely hold credentials to some of the most sensitive operational technology environments in critical infrastructure. The business rationale for this access is straightforward. The security governance surrounding it frequently is not.
The Scope of Third-Party Exposure
Modern industrial facilities depend on an ecosystem of external providers. Original equipment manufacturers require remote access to monitor and maintain the systems they sell. Automation vendors need connectivity to perform updates and diagnostics. Specialized contractors access control environments during planned maintenance windows, and sometimes outside of them. Each of these relationships represents a trusted access channel that, if compromised or misused, can provide an adversary with direct entry into operational systems.
The most significant industrial cybersecurity incidents of the past decade have involved third-party access as either a primary attack vector or a contributing factor. The pattern is consistent enough that it should be treated as a predictable risk category rather than an exceptional scenario.
Where Governance Typically Falls Short
The gaps in third-party access governance tend to cluster around the same structural weaknesses. Access credentials are shared among multiple individuals within a vendor organization, making attribution of specific actions impossible. Remote sessions are not monitored or recorded, meaning that what a vendor does during an access event may be entirely invisible to the asset owner. Access permissions granted for a specific project or maintenance activity are not revoked when the work is complete, leaving persistent entry points that no current business need justifies.
Contract and procurement frameworks frequently address third-party cybersecurity at a surface level, requiring vendors to attest to security policies without establishing meaningful audit rights or accountability mechanisms for actual security practices.
What Effective Third-Party Access Management Looks Like
Organizations that manage third-party OT access effectively apply a consistent set of principles. Access is provisioned on a least-privilege basis, scoped to the specific systems and functions required and nothing more. Sessions are conducted through monitored channels that create an auditable record of activity. Credentials are individual rather than shared, and access is time-limited, requiring reauthorization when business need continues. Vendors are subject to periodic security assessments proportionate to the sensitivity of the systems they can reach.
These are not extraordinary requirements. They are basic access hygiene applied to a context where the stakes justify it.
The Leadership Conversation That Needs to Happen
Operational leaders who have built long-standing vendor relationships often resist what they perceive as additional friction in those relationships. The more accurate framing is that third-party access governance is a condition of sustainable partnership, not an obstacle to it. Vendors who cannot operate within reasonable security parameters represent a risk exposure that the asset owner, and ultimately the public depending on the infrastructure they operate, will bear.
Establishing that standard is a leadership decision, and it begins with understanding the current state of third-party access across the organization.
