When an equipment supplier connects to your production line, someone at your company should know what they can reach and when the connection will end. A small plant does not need a complicated workbook to manage that. It needs a clear owner and a few reliable checks.
This is different from supporting an office laptop. A remote change could affect how equipment runs. The person approving the work needs to understand the process, not just the login.
Start with the work being requested
Suppose a supplier needs to investigate a packaging machine fault. An account that can reach every machine is not the same as permission to inspect that one fault. Agree on the equipment and the permitted work before opening access.
- Name the person at the plant who approves the session.
- Identify the supplier technician and the equipment involved.
- Agree on whether the technician may only inspect or also make changes.
- Set a work window and identify who can stop the session safely.
Involve the production or engineering owner in that decision. Do not bypass machine safety procedures to make remote support easier.
Three simple control and evidence pairs
These are examples to adapt to your equipment and support arrangements. They are not a complete manufacturing compliance checklist.
1. Approve the session before it starts
Example control: The equipment owner approves remote support for a specific purpose and work window. A change to the agreed work needs further approval.
Evidence to keep: The maintenance ticket with the approval and scope. A short note can record any limits, such as inspection only or no changes while the line is running.
Avoid a ticket that says only “vendor access approved.” It leaves the next shift guessing about what was allowed.
2. Know who connected and what happened
Example control: Remote support uses an approved connection that identifies the technician. Someone responsible for the equipment knows when the work begins and how to contact the technician.
Evidence to keep: Connection records linked to the maintenance ticket. Add the technician’s work summary and references to any approved changes. Keep relevant machine alarms or change records when they help explain the outcome.
A login record proves a connection occurred. It does not prove that every action was appropriate. Review the information against the agreed work when closing the ticket.
3. Close the access and hand back the equipment
Example control: After the work, the responsible staff confirm the equipment’s agreed operating checks and remove access that was only needed for the session.
Evidence to keep: The operating check result and confirmation that temporary access ended. Identify who checked each result. Record unresolved problems instead of marking the whole job successful.
Closing the maintenance ticket alone does not establish that an account or session stopped working.
When the supplier says access must stay on
Some equipment needs ongoing remote monitoring. Treat that as a different arrangement from temporary repair access. Specify what the supplier can see or change and who reviews the arrangement. A monitoring need should not silently become permission for unrestricted maintenance.
If the equipment cannot support modern login controls, have the equipment supplier and a qualified industrial security specialist design an appropriate access path. Do not install office security tools or disconnect production equipment without checking the operational impact.
Keep the record in the ticket you already use
- What equipment and work were approved?
- Who approved and performed the work?
- What happened during the session?
- Was the equipment handed back in the agreed condition?
- Did temporary access end? What remains open?
Link to logs rather than copying every log entry into a tracker. Protect those records because they may reveal sensitive equipment details.
What this supports
These checks help you demonstrate controlled supplier access. They do not establish compliance with every customer contract or manufacturing requirement. Start with the obligations that actually apply to your plant and the systems in scope.
For technical design, NIST’s Guide to Operational Technology Security addresses remote access without undermining safety. Section 6.2.10 covers justified access and its removal. The Australian Signals Directorate’s remote access guidance adds practical steps for coordinating and recording supplier sessions. The examples above translate those principles into a small-team workflow.
This article uses NIST Revision 3 as the final publication. Revision 4 was an initial public draft when checked on November 8, 2026.