The practical question
Can the business name every outside party that can reach an important system, explain why access exists and remove it without waiting for the vendor to volunteer the answer?
Manufacturers often need outside access. A machine supplier may support equipment, an IT provider may maintain business systems and a specialist may connect during a scheduled service window. Remote access can be necessary and useful.
The risk appears when access becomes permanent, broad, invisible or owned entirely by someone outside the business. A manufacturer may know that a provider “looks after the system” without knowing which account is used, what else it can reach or how the relationship would end.
The Canadian Centre for Cyber Security describes supply chains as digital information and connections as well as products and money. Its guidance recommends knowing vendors that access data or support critical functions, assessing their importance and asking practical questions about protection and recovery.
Start with the critical-vendor map
List managed IT, networking, backup and security providers; ERP, accounting, quoting and scheduling platforms; equipment and maintenance vendors; cloud and file-sharing services; shipping, payment and customer portals; and connected building services.
Not every vendor needs the same review. A provider that can reach a critical system or sensitive information deserves more attention than one that only delivers office supplies.
Seven questions for every critical provider
1. What does the vendor access?
Identify the actual application, server, workstation, cloud tenant, folder, machine or portal. “The network” is too vague.
2. Which account is used?
Record named accounts, service accounts, shared logins, remote-management agents and temporary connections. Identify the account owner and administrator.
3. When is access allowed?
Document whether access is always on, approved for a service window, triggered by a support request or dependent on someone at the plant.
4. How is access protected and recorded?
Ask about MFA, least privilege, device controls, session logging, approval records and support personnel. The manufacturer should be able to determine what happened.
5. What information moves through the relationship?
Consider drawings, specifications, pricing, customer requirements, production schedules, quality records, credentials, service logs and configuration data. Use the minimum information needed.
6. How is a problem reported?
Record the contact path for a security event, suspected compromise, lost device, unauthorized access or outage. Do not rely on one email inbox.
7. How does the relationship end?
Offboarding should remove accounts, agents, credentials, tokens, keys, devices and remote sessions, while returning information and transferring administrator control.
A simple vendor register
| Field | Record |
|---|---|
| Provider | Company, service and business owner |
| Critical function | What would stop or materially delay |
| Access | Systems, devices, facilities, data and accounts |
| Protection | MFA, approval, restrictions and logging |
| Recovery | Escalation path, backup contact and workaround |
| Offboarding | How access and information are returned or removed |
| Review | Last review, next review and open action |
Update the register when a supplier, system, account or scope changes. The Cyber Centre recommends minimum supplier-security requirements, incident-notification expectations and regular re-evaluation.
AI and remote access overlap
A quoting assistant, document tool, meeting transcription service or integrated Copilot may reach information through existing accounts and permissions. The business should know what it can access and what the vendor’s controls do. See Manufacturing Cybersecurity and AI Adoption for the AI-specific discussion.
Keep OT boundaries clear
This article covers business ownership, provider oversight, access decisions, information handling and recovery planning. It does not certify an industrial-control environment, validate machine safety or replace operational-technology engineering. For the business-side question, connect vendor access to Backup & Recovery Validation and Break-Glass Readiness.
Where CyberTECT fits
CyberTECT can help an Ontario manufacturer build a critical-vendor register, document remote-access dependencies, identify ownership and offboarding gaps, review information flow and establish priorities. Begin with the Digital Operations Checkup.
Frequently asked questions
What should a manufacturer know about vendor remote access?
Know which vendors can connect, which accounts they use, which systems they can reach, when access is approved, how activity is recorded and how access is removed.
Should manufacturers ban remote vendor access?
Not necessarily. Remote access may be needed for support. The goal is to make it authorized, limited, visible, protected and removable.
Does this cover industrial-control engineering?
No. It covers governance of vendor access and business-system dependencies. Specialized OT, machine-safety and engineering work should be separately scoped.
Start with the provider who could stop the work
Ask for the account, access, information, logging, recovery and offboarding details in writing.
Authoritative sources
- Canadian Centre for Cyber Security – Cyber supply chain security
- Canadian Centre for Cyber Security – Baseline cyber security controls
- CISA – Assessing vendors and suppliers
General operational information only. This article does not provide industrial-control, machine-safety, engineering, legal, privacy or regulatory advice.
CyberTECT resources provide general operational guidance. They do not replace advice specific to your legal, regulatory, contractual or technical circumstances.