What it means
OT vendor access monitoring observes and evaluates external support sessions, commands, file transfers, configuration changes, tools, targets, and outcomes against approved work.
Why it matters
Authorized vendor access can still be excessive, compromised, misdirected, or inconsistent with the maintenance purpose.
Practical focus
- Require a named sponsor, approved ticket, identity, device, time window, target list, purpose, and expected commands or files.
- Record or otherwise preserve session activity, monitor privileged actions, control transfers, and correlate changes with controller and process events.
- Review completion, remove access, validate system state, collect vendor deliverables, and investigate deviations.
- Preserve this evidence: Retain the request, approvals, identity and device evidence, session logs or recordings, transferred files, changes, validation, deviations, and revocation.
- Exercise this failure scenario: A valid support account accesses additional assets or uploads an unapproved tool during a maintenance window without detection.
Common mistakes
- Using the label OT Vendor Access Monitoring without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that OT Vendor Access Monitoring operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: A valid support account accesses additional assets or uploads an unapproved tool during a maintenance window without detection.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: