Official intent
Know and limit who — and what — can access and change production systems. The official source remains authoritative.
Read the official campaign ↗Why it matters
If everyone shares one login, you cannot tell who made a change or stop a compromised credential. Default and vendor accounts are among the most common OT footholds. Controlling access limits both malicious action and honest mistakes on systems where a wrong command has physical, sometimes safety-critical, consequences.
Access changes on production systems can lock out operators when they need control most. Never remove or alter credentials on a live system without the process owner's agreement, a tested rollback, and break-glass access that works during a network or identity outage. Prioritize safety and availability over tidy identity design.
Minimum / Strong / Advanced
Default passwords are changed, generic shared logins are inventoried, and vendor/standing accounts are known and controlled.
Individuals have unique, least-privilege access; engineering/administrative functions are restricted; and access is reviewed on a schedule.
Access is centrally managed with MFA where the environment supports it, privileged actions are logged, and joiners/movers/leavers are handled promptly — with break-glass preserved.
Implementation timeline
- Find default and vendor-set passwords on reachable devices
- List every shared/generic login in use
- Change safe-to-change default credentials in a maintenance window
- Confirm break-glass access exists and is tested
- Assign unique accounts and least privilege where feasible
- Restrict engineering functions to authorized staff
- Review vendor and standing accounts; disable the unneeded
- Set a recurring access review tied to change control
Implementation steps
- Inventory who and what can access each production system, including vendor and shared accounts.
- With the process owner, change default and vendor-set passwords within maintenance windows.
- Move toward unique, least-privilege accounts so actions are attributable and over-access is removed.
- Restrict engineering and administrative functions to authorized personnel and log their use.
- Establish and test break-glass access, then review accounts on a schedule tied to change control.
Validation
- Pick a production device and confirm it no longer uses a default or vendor-set password.
- Verify break-glass access works with the identity system or network unavailable.
- Review the account list for shared logins and disabled-but-not-removed vendor accounts.
Evidence to retain
OT access-control policy including vendor and break-glass procedures
Account inventory and privilege assignments per system
Maintenance-window change records for credential changes
Access-review sign-off and break-glass test results
Common failure modes
Changing a password and breaking an automated process that used it, leaving a vendor's standing account active between visits, and adding MFA that locks operators out during an outage. Attribution without safe recovery is not access control.
Framework mappings
Independent mappings are aids, not authoritative equivalence or compliance determinations.