FireSight OT · vendor and third-party access
Vendor remote access for OT, limited to the machine and the hours
Machine builders, integrators and service companies need into your plants, but briefly and only to their own machines. FireSight OT gives third-party and vendor remote access its own kind of account: two-factor sign-in, access hours, an end date, and sessions that close when time is up. Every session is in the audit log.
The problem
Why third-party remote access goes wrong
The whole network
A vendor needs one PLC. A site VPN account lands them on the whole machine network, and often beyond it.
Accounts that never end
The commissioning project finished a year ago. The shared account and the remote-desktop tool on the HMI PC are still there.
No record of who did what
When something changes on a line, nobody can say which vendor engineer was connected, or for how long.
Vendor accounts
Vendor remote access with rules built in
In FireSight OT, an external vendor is its own kind of account. The rules come with the account, so nobody has to remember to apply them.
- Two-factor sign-in, always. Vendor accounts must use an authenticator app (TOTP), whatever the setting for staff.
- Access hours. For example weekdays 07:00 to 18:00. Sign-in is refused outside those hours.
- An end date. The account stops working when the project or contract ends.
- Sessions close at time-up. When the hours or the end date run out, open connections are closed, not left running.
- Only the machines granted. Vendors never get whole networks unless that is explicitly allowed.
- A named person per account. No shared logins, so the audit log means something.
Structure
Divisions, vendors and who manages them
Nothing is visible by default. Access is granted per machine or per Cloud Connector, to the right group of people.
Plants, lines and teams
Split each company into divisions such as plants, lines or maintenance teams, and grant machines to a division rather than to people one by one.
One group per supplier
Each machine builder or integrator is a vendor with its own people. Grant them their own machines, and nothing else.
Local administrators
Division operators manage only their own division's people and grants, so a plant can handle its own vendors.
Grants never cross companies
One Hub can serve several companies, kept fully separate. A grant in one company can't reach another's machines.
The plant sets the limit
An allowlist on each Cloud Connector, set at the site, caps what the Hub may reach. No grant can go past it.
Your rules for everyone
Allowed source networks for sign-in, idle timeouts and a limit on connections per person, as company policy.
Evidence
An audit trail for every vendor session
When you need to know what a vendor did, the Hub's audit log and session transcripts answer it.
| What | What's recorded |
|---|---|
| Sign-ins | Every sign-in to the Hub, by staff and vendors alike. |
| Sessions | Who opened which machine, from where, when, for how long and how much data, with the person's vendor or division. |
| Changes | Grants, accounts and settings changed on the Hub, and by whom. |
| Terminal sessions (new in 0.3.0) | Browser SSH, Telnet and serial console sessions are recorded as text transcripts, kept for 90 days and linked from the audit log for administrators. |
| Remote desktop (planned for 0.4.0) | Session video recording for RDP and VNC, played back from the audit log. |
NIS2
Third-party remote access and NIS2 supply chain security
Article 21(2)(d) of NIS2 asks in-scope organisations to secure their relationships with suppliers and service providers. For a manufacturer, the machine builder's remote access is one of the most direct of those relationships.
Vendor accounts, two-factor sign-in, access hours and the audit log are practical evidence for that measure. Read how FireSight OT helps with NIS2.
No product makes an organisation NIS2-compliant. This is general information, not legal advice.
For machine builders on the other side: the same vendor accounts are how your engineers reach machines on a customer's own Hub. See remote support for machine builders.
Want to see a vendor account cut off at the end of its hours? Ask us for a demo.
FAQ
Questions people ask
How do I limit a vendor's remote access to working hours?
Give the vendor's engineers vendor accounts with access hours, for example weekdays 07:00 to 18:00. Sign-in is refused outside those hours and open sessions are closed when the time is up.
Can a vendor's access expire automatically?
Yes. Vendor accounts can have an end date, after which they stop working.
Do vendors have to use two-factor authentication?
Yes. Vendor accounts always require two-factor sign-in with an authenticator app, whatever the setting for your own staff.
Can I see what a vendor did during a session?
The audit log records who opened which machine, when, for how long and how much data. Browser terminal sessions (SSH, Telnet and serial) are also kept as text transcripts for 90 days; video recording of remote desktop sessions is planned for 0.4.0.
Does vendor access help with NIS2?
It supports the supply chain security measure in Article 21(2)(d) with vendor accounts, two-factor sign-in and an audit trail, but no product makes an organisation NIS2-compliant on its own.
See it on a test line
Tell us about your sites and who needs to reach them. We'll show you FireSight OT in a live demo Hub, with real machines behind a Cloud Connector.
