Documentation
NIS2 and OT remote access: compliant remote maintenance
Remote maintenance is often the most fragile door of an industrial site: contractor accesses accumulated over the years, heterogeneous tools, shared accounts, few traces. The European NIS2 directive extends cybersecurity obligations to many sectors — including a large part of industry — and puts precisely these accesses under the spotlight. This page explains, at a high level, what NIS2 expects of OT remote access, how IEC 62443 helps structure the technical answer, and how VIGIL-MESH equips the 'remote access' building block point by point: identity-based control, MFA, logging, end-to-end encryption, machine-by-machine least privilege.
What NIS2 expects of remote access
NIS2 is a European directive: it imposes cybersecurity risk-management measures and reporting obligations on the entities in scope, transposed into each member state's law. Without quoting articles, the expectations that directly touch remote maintenance sum up well:
- Manage risks, not just incidents. Know which accesses exist, who holds them, what they allow — and be able to demonstrate it.
- Control and log accesses — including contractors’. The supply chain is in scope: the machine builder’s or external maintainer’s access must be governed just like an employee’s.
- Authenticate strongly. Multi-factor authentication is among the expected measures for sensitive access.
- Apply least privilege. A person should reach only what their task requires — not the whole site because ’the VPN gives access to everything’.
- Know your assets. An up-to-date inventory of what is connected, and of what is remotely reachable, is the prerequisite for everything else.
IEC 62443: the technical framework of zones and conduits
Where NIS2 sets high-level obligations, the IEC 62443 series provides the technical vocabulary OT uses to answer them: split the installation into zones (groups of assets sharing the same security needs) connected by conduits (controlled communication channels between zones). A remote maintenance access is exactly that: a conduit crossing the zones — from a technician's workstation, often off-site, to a device at the heart of the installation.
Seen as a conduit, remote access must be authenticated (who is at the other end), encrypted (nobody reads along the way), scoped (it leads only to the intended assets) and logged (you can replay who did what). That is where the historical approaches fall short: the whole-site VPN opens a conduit to an entire zone, the modem or remote-control tool installed by a contractor creates a conduit nobody governs, and shared accounts make the logs unverifiable.
Expectation by expectation: how VIGIL-MESH equips the answer
VIGIL-MESH builds an encrypted private network between authorized machines — the agent installs on Windows, Linux, Android and Jetson, and the browser can become an ephemeral node. No inbound port is opened anywhere, and a bare PLC is reached through a site gateway, machine by machine. On that base, each high-level expectation gets a concrete answer:
| Expectation (high level) | VIGIL-MESH answer |
|---|---|
| Identity-based access control | Default-deny ACLs: rules written in terms of identities, groups and tags — never addresses. What is not explicitly allowed is denied. See the access policies. |
| Logging of accesses and operations | The console’s audit log traces operations: who, what, when — by named identity, usable in periodic reviews. |
| Multi-factor authentication | MFA is required on sensitive account and console operations. |
| Encryption of communications | QUIC/TLS 1.3 sessions encrypted end to end, hybrid post-quantum key exchange; relays are structurally blind and a private vigie can be self-hosted. Details in the security model. |
| Least privilege | Access is granted machine by machine — never a whole subnet: the contractor sees only the machine and port their task requires, and nothing else is reachable. |
| Inventory of connected assets | The console inventory lists every enrolled machine, its status and its last connection; suspension and revocation are immediate. |
- Every enrolled machine appears in the inventory, with its real-time status.
- Its last connection to the network — an inventory item directly usable in reviews.
- Suspend or revoke: access drops immediately, without waiting for a token to expire.
Bringing maintenance contractors' access into compliance
The picture is almost always the same from one site to the next: external maintainers' accesses have piled up without governance.
- A whole-site VPN shared with several contractors — each one sees the entire zone, not just their machine.
- Generic accounts ('maintenance', 'service') used by changing people — the logs no longer prove anything.
- Remote-control tools installed over years of troubleshooting, without MFA or centralized traces.
- No reliable inventory of what is reachable from outside — the question 'who can reach this PLC?' has no demonstrable answer.
- 1Take a census of what existsList every active remote access — VPNs, forwards, remote-control tools, modems — with its holder and its target. This census is also the first deliverable an audit will ask for.
- 2Enroll the legitimate access pointsThe gateway or supervision PC of each zone receives the VIGIL-MESH agent and joins the private network with a single-use key — no inbound port. PLCs without an OS are reached through that machine, declared machine by machine.
- 3One identity per personEvery technician — internal or contractor — has their own identity, protected by MFA. No more shared accounts: every trace in the log designates a person.
- 4Write least-privilege ACLsDefault deny, then narrow rules: this contractor reaches only that machine, on that port. Rules speak of identities, never of addresses — see the access policies.
- 5Move the sessions over, close the old pathsInterventions go through the private network — SSH terminal from the browser or client on the workstation — then the legacy accesses (shared VPN, forwards, untraced tools) are removed one by one.
- 6Keep it under control over timePeriodic review of the audit log and the inventory; when a technician leaves, revocation is immediate and its effect verifiable.
The full picture of the use case — machine fleets, OEMs, network zones — is described in Industrial remote maintenance.