What is a key practice when evaluating third-party maintenance providers who have direct access to OT systems?

What is a key practice when evaluating third-party maintenance providers who have direct access to OT systems?

• A. Restrict third-party access to only during daytime business hours.
• B. Evaluate access controls, monitoring, credential management, session recording, and post-visit remediation and audit trails.
• C. Provide unrestricted access to OT systems.
• D. Avoid recording sessions to protect privacy.

Answer: (B)

Controlling and auditing third-party access to OT systems requires a comprehensive approach that makes access traceable, restricted, and reviewable. When evaluating a provider, focus on how access is limited and monitored: robust access controls to enforce least privilege and network segmentation; ongoing monitoring to detect anomalous activity; credential management to protect privileged accounts; session recording to capture actions for accountability and post-visit review; and a clear process for post-visit remediation and audit trails to verify what was done and ensure accounts are closed or re-validated afterward. This combination helps prevent unauthorized changes, quickly detect incidents, and provide a defensible audit trail after each maintenance visit. Time-limiting access or unrestricted access do not provide the necessary safeguards, and avoiding session recording removes critical traceability needed for investigations and compliance.

Controlling and auditing third-party access to OT systems requires a comprehensive approach that makes access traceable, restricted, and reviewable. When evaluating a provider, focus on how access is limited and monitored: robust access controls to enforce least privilege and network segmentation; ongoing monitoring to detect anomalous activity; credential management to protect privileged accounts; session recording to capture actions for accountability and post-visit review; and a clear process for post-visit remediation and audit trails to verify what was done and ensure accounts are closed or re-validated afterward. This combination helps prevent unauthorized changes, quickly detect incidents, and provide a defensible audit trail after each maintenance visit. Time-limiting access or unrestricted access do not provide the necessary safeguards, and avoiding session recording removes critical traceability needed for investigations and compliance.