November is Critical Infrastructure Security and Resilience Month, and CISA's 2026 theme is "Resolve to be Resilient." This year, the agency is asking infrastructure owners and operators to focus on four practices: know your infrastructure and its dependencies, prioritize the risks that matter most, make actionable plans, and measure progress.
For mid-sized energy operators, such as electric cooperatives, municipal utilities, midstream operators, and renewable generation sites, one dependency deserves more attention than it usually gets: the outside vendors who can reach into your operational technology (OT) environment from somewhere else.
Modern energy operations run on vendor support. The SCADA integrator who tunes your HMI. The OEM that monitors turbine or compressor performance. The controls contractor who troubleshoots a PLC at 2 a.m. so a crew doesn't have to drive out to a remote site.
That access keeps operations running and costs down. It's also one of the most common ways attackers get into industrial environments. In a 2025 Claroty survey of cyber-physical systems organizations, including power and energy respondents, 46% said they had experienced a breach in the past 12 months caused by third-party access.
Attackers don't need to break into a control network if they can log in through a trusted connection someone else already set up.
Secomea's State of Industrial Remote Access 2026 report surveyed manufacturing and critical infrastructure organizations. Several findings stand out for energy operators:
Put simply: many operators can't say with confidence who connected to their OT environment last month, what they did while they were in, or whether the account they used should still exist.
Few utilities set out to build an unmanaged access path. It happens gradually.
A vendor installs a remote access tool during commissioning and it never comes out. A contractor finishes a project but their account stays active. Three vendors use three different remote tools, each approved separately. A shared login gets passed between technicians at the vendor's office. A firewall rule opened "temporarily" for an emergency fix is still open two years later.
None of these decisions look risky in the moment. Together, they create a set of always-on doors into the systems that keep power flowing and pipelines moving, many of them monitored by nobody.
Applying CISA's four practices to remote access gives energy operators a practical checklist.
Know the paths. Inventory every way an outside party can reach OT: vendor-installed tools, VPN accounts, cellular modems, jump hosts, and cloud-connected monitoring. Include who owns each one and why it exists.
Give every person their own identity. Shared vendor logins make investigation nearly impossible. Each technician should authenticate individually, with multifactor authentication.
Grant access when it's needed, not all the time. Just-in-time access, approved per session and closed when the work is done, removes the standing connections attackers look for.
Record and review sessions. Session logs and recordings turn "we think the vendor was in on Tuesday" into a clear record of what happened.
Separate and monitor the boundary. Vendor access should land in a controlled zone, not directly on the control network, with monitoring at the IT/OT boundary for activity that doesn't match the approved task.
Have a kill switch. If a vendor reports a breach of their own systems, you should be able to cut their access to your environment in minutes and know exactly what that affects.
Measure it. Track how many access paths exist, how many are consolidated, and how often credentials are reviewed. Progress you can measure is progress you can defend to a board or a regulator.
Large utilities often have dedicated OT security teams and formal vendor access programs. Mid-sized operators typically rely on a small engineering staff who are experts in operations, not in security architecture. They depend on vendors more, which makes vendor access both more important and harder to govern.
That's not a reason for alarm. It's a reason to treat remote access as an operational risk with an owner, a process, and a plan, the same way you'd treat a critical spare part or a backup generator.
If you're not sure how many vendors can reach your OT environment today, that's the first answer to get. From there, the highest-value steps are usually closing unused access paths, ending shared accounts, and putting session approval in front of the connections that remain.
Tec-Refresh works with energy and utility operators to map OT dependencies, assess remote access paths, and build vendor access practices that support operations instead of slowing them down.
This Critical Infrastructure Security and Resilience Month, we're offering a one-hour OT/ICS security consultation for energy operators. Bring your questions about vendor access, segmentation, or monitoring, and leave with clear priorities for your environment.
Resilience isn't only about recovering after something breaks. It's also about knowing who can reach your most important systems, and making sure every one of those doors is one you chose to open.