tandmm
Back to Resources

Practical OT Security No. 1

· OT Vendor Access Review

When the vendor finishes, what access remains?

For small and mid-size utilities and the integrators who support their OT systems.

Use this worksheet with operations, controls engineering, and security to review one vendor connection. Record how access is approved, what ends when work finishes, and which operational services depend on the connection.

Inside the worksheet

  • Two worksheet pages and a two-page fictional water-utility example
  • A 90-day comparison of vendor work hours and hours when access was available
  • Questions covering approval, session termination, remaining authorization, operational dependencies, and safe validation
  • Space to assign unresolved questions to an owner
Download PDFDownload editable Word copy

Free downloads. No registration required.

First page of the OT Vendor Access Review with fields for identifying a vendor connection, comparing 90-day work and access hours, checking approvals, and recording remaining access
Preview of the first worksheet page. The download includes all four pages.

How to use it

  1. Choose one vendor connection.
  2. Review it with operations, controls engineering, and security.
  3. Assign the unknowns and agree on the next action.

These worksheets are TANDMM’s interpretation of NSA’s October 2026 guidance, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles. Pages 10-11 address remote and third-party access. Pages 16-17 address safe validation. No NSA endorsement of these resources or any product is implied.

NEXT STEP · PRACTICAL OT SECURITY NO. 2

OT Disconnect and Reconnect Planning

Establish what depends on a connection, how staff will manage the disconnect control, and what must be checked before restoring access.

View No. 2

Questions about your environment? Contact TANDMM.