Securing Vendor Remote Access to OT Through a Monitored Jump Host

Vendors should reach industrial control systems through a jump host in the industrial DMZ rather than a direct network route into the control network. Access should be granted per named person, per target, and for a defined time window, with MFA required and sessions recorded. Common weaknesses include forgotten VPN accounts that stay active for years and default passwords on cellular routers that no one tracks. Guidance from CISA and NIST SP 800-82 Rev. 3 treats remote access as a boundary requiring dedicated controls. Operators are also advised to approve sessions in real time and to record any permanent vendor connection as a documented exception with an owner and review date.