An illustrative remote-access review
Suppose a supplier supports a packaging line through a remote-access gateway. The question is whether its session can reach more controllers than intended. Start with approved architecture records, gateway configuration exports and existing connection logs. They describe the configured access and some observed use without requiring test traffic to the controllers.
Compare those records with the operator's normal maintenance workflow. A rule permitting access to another controller establishes a configured path. A matching session record may show that the path was used. Do not infer the second observation from the first. Preserve the distinction in both the proposed restriction and the report.
Connecting permission to the operating conditions
Put the asset owner, operating state, acceptable interruption, approved window, recovery authority and named stop contact in the test permit. Organize it around the process or operational boundary being examined. If a safety field is unresolved, resolve it before proceeding. An empty field does not delegate that decision to the testing team.
| Proposed activity | Condition for proceeding | Evidence to retain |
|---|---|---|
| Review existing logs | The operator has approved the source and collection method. | Source, time range and collection impact |
| Observe network traffic | The collection point is approved and introduces no unreviewed inline equipment. | Capture limits and sensitive-data handling |
| Exercise access restrictions | A representative environment or an approved maintenance window is available. | Expected result, rollback and operator acceptance |
| Change a controller | Engineering has separately authorized the change and its recovery plan. | Validated configuration and change record |
Validate a bounded change
Evaluate the proposed gateway restriction against an approved representation of the maintenance workflow, including emergency support and loss of the remote connection. Save the prior configuration and arrange local recovery access. Agree with operations on observable stopping conditions, such as a process alarm or loss of required supervision, before making the change.
During an authorized production window, collect only from the approved paths. Have operations determine whether the process and maintenance functions remain usable. One minute of normal behavior after saving a configuration may cover very little of the operating cycle. Monitor across the relevant cycle before concluding that the change works as intended.
The process remains the limit on the method
NIST SP 800-82 Revision 3 is the final OT guidance referenced here. Revision 4 was published on September 21, 2026 as an initial public draft; identify it as a draft when using it in a decision. MITRE ATT&CK can help organize threat questions, but checking off techniques does not establish process safety.
This worksheet does not authorize active testing or replace engineering, vendor or safety review. Passive collection also has operational and confidentiality consequences. Identify excluded operating modes, assets and supplier paths in the report, so a result about the reviewed portion is not mistaken for a conclusion about the entire plant.
Sources and reference editions
- NIST Guide to OT SecurityRevision 3 final; Revision 4 initial public draft 2026-09-21
- MITRE ATT&CK August 2026 release19.2, 2026-08-06