IEC 62443 engineering guide →
Start with the industrial system, the accountable roles and the decision being reviewed. Then connect risk, architecture and operational evidence rather than collecting product labels without their deployment context.
Working sheet 02 · OT & ICS · No email gate
OT remote access: prove the boundary before the session.
Review one integrator, one maintenance route and one operational task. Record who can connect, what they can change, and how the plant retains control when the session or its supporting services fail.
Evidence assembled does not mean access approved. These are CUP engineering review prompts, informed by the sources below. The plant's authorised decision owner determines the task, operational constraints and residual risk. Validate changes in an approved test environment; this worksheet does not authorise testing on a live plant.
Standards in engineering practice
Start with the framework. Follow the evidence.
Twelve review checkpoints
Keep the maintenance path useful and its authority bounded.
Use a separate exported copy for each review. In each note, record the evidence reference, accountable owner, open gap and next review date. Mark the checkbox only when the evidence has been assembled. No score or approval is calculated.
Changes are saved in this browser on this device when storage is available. They are not sent to CUP. Use record references rather than passwords, keys or sensitive plant details; other users of this browser profile may be able to read saved notes.
Local saving and export become available when the worksheet loads.
| Checkpoint | Evidence to assemble | Decision to resolve | Review status and notes |
|---|---|---|---|
| 01 · Task and operational scope | Named site and system, maintenance purpose, work order, plant owner, permitted window and operational constraints. | What task justifies this connection, and who can approve or stop it? | |
| 02 · Named operator and authentication | Authorised personnel list, individual account, authentication method, identity owner and evidence that departed staff lose access. | Can the plant attribute this session to a person rather than a shared vendor account? | |
| 03 · Engineering workstation | Device owner, supported baseline, privileged-access controls, update evidence and restrictions on unrelated browsing or software. | What prevents compromise of the integrator device from becoming privileged plant access? | |
| 04 · Permitted actions | Target assets, allowed commands and roles, read-only versus control permissions, escalation approval and rejected-action test results. | Can a valid session perform an unapproved control or administrative action? | |
| 05 · Mediated connection path | Route diagram, boundary devices, destination allowlist, approved protocols and evidence that alternate or direct routes are closed. | Does every usable route cross the intended access boundary? | |
| 06 · Session lifetime | Just-in-time enablement, expiry, idle timeout, session termination and verification after the maintenance window closes. | Does closing the work order also remove the usable access path? | |
| 07 · Deployment and file transfer | Approved change reference, artefact digest or revision, transfer review, deployment authority and rollback plan. | Does permission to connect also grant permission to deploy a different configuration or executable? | |
| 08 · Session and change evidence | Attributable session and target logs, time context, integrity protection, retention owner and a bounded evidence-retrieval process. | Can a reviewer reconstruct who changed what without granting investigators plant-control permissions? | |
| 09 · Incident isolation | Named isolation authority, dependencies, communication method and tested effect of terminating the remote route. | Can the plant contain this route while preserving required safety and operational functions? | |
| 10 · Degraded operation and recovery | Behaviour during WAN or identity-service loss, bounded emergency access, local approval, recovery baseline and post-event review. | Can authorised recovery proceed without opening permanent bypasses or defeating safety interlocks? | |
| 11 · Integrator responsibilities | Contracted access rules, subcontractor scope, customer-data handling, incident notification, patch responsibilities and support exit arrangements. | Which responsibilities remain with the plant, and which evidence must the integrator supply? | |
| 12 · Revoke and reassess | Account and token revocation, removed tunnels, rotated shared dependencies where needed, next review date and change triggers. | What proves access has ended, and what change requires this decision to be reviewed again? |
Primary guidance · reviewed 1 November 2026
Check the guidance against your operational scope.
The questions above are CUP's review structure, not a reproduction of a standard, an official agency checklist or a certification result.
Joint guidance: secure OT connectivity
Principles for assessing connectivity, controlling exposure, monitoring connections and planning isolation.
Read the joint guidance →NCSC: privileged access workstations in OT
Considerations for engineering workstations, third-party access and operation during loss of supporting services.
Read NCSC guidance →CISA and FBI: third-party ICS integrators
The agencies' fact-sheet announcement highlights contractual responsibilities, authorised personnel, remote access and exposure reduction.
Read the official announcement →