Begin with the service the supplier supports
A remote-access review in an energy or utility organization should start with a clear business and operational purpose. Identify the service being supported, the supplier’s responsibilities and the people accountable for the affected systems. An enterprise application and an operational control system may have very different dependencies. Put the responsible owners in the discussion before proposing changes to accounts, connection methods or support arrangements.
Keep enterprise IT and operational scope explicit
Operational technology (OT) can interact with physical processes, so performance, reliability and safety matter alongside security. NIST SP 800-82 Rev. 3 addresses these characteristics. A review of business IT access does not by itself authorize testing or changes to operational systems. Agree where the review stops, which specialist input is required and how a previously unknown connection will be handled if it crosses that boundary.
Build a record of the access arrangement
For one selected supplier, record the business sponsor, technical contact, supported systems and approved connection method. Ask whether access is permanent or associated with particular support tasks. Include the accounts, authentication requirements and the process for approving a session or change, where applicable. Keep credentials out of the review document. The record should allow another authorized colleague to understand the arrangement without relying on the memory of one contract manager.
Review permissions in the context of support work
Ask which tasks the supplier actually performs and which administrative privileges they require. Check how account ownership is maintained when supplier staff change. Multifactor authentication, access restrictions and session visibility should be assessed against the selected technology and operating requirements. NIST’s enterprise telework and remote-access guide provides additional background on securing remote connections. A tool’s legitimate support purpose does not remove the need to govern how it is installed, used and monitored.
Agree what happens when something is unexpected
Define who can pause an access session, who investigates unusual activity and how operational owners will be contacted. Check that the escalation route works during the supplier’s support hours and the organization’s operating schedule. Logging arrangements should have an owner and an agreed review purpose. Where technology cannot provide a desired control, document the limitation and obtain a decision about appropriate alternatives rather than assuming the gap is covered elsewhere.
Treat a proposed restriction as a planned change
Closing an unfamiliar connection without understanding its purpose can interrupt legitimate support. Confirm dependencies, obtain the required approvals and choose suitable validation checks before implementing a change. For operational systems, involve the appropriate specialists and account for vendor and safety requirements. Agree rollback arrangements where a change can be reversed. Emergency security decisions still need the organization’s established escalation process and responsible operational judgment.
Use a supplier review meeting to find missing ownership
Select one access arrangement and ask the sponsor to describe the last support activity it enabled. Ask the technical owner how that activity was approved, recorded and completed. Compare the answers with the contract and access records available. List unanswered questions, proposed changes and required specialist reviews separately. Finish with named owners and review dates, including a plan for what should happen when the supplier engagement ends.
Choose a controlled starting point
Begin with agreed enterprise IT access or a documented boundary review, then decide whether a separate OT engagement is needed. DBNETIT’s Network Security service can help review selected access paths, network controls and improvement priorities. The objective is a clearer, maintainable access arrangement, with operational decisions remaining with the people authorized to make them.