Composite Scenario: Vendor Media in an "Air-Gapped" Environment
The following scenario combines recurring control gaps and does not describe a single customer or site.
An industrial facility considers itself isolated, yet backup media moves between vendor engineers and maintenance staff without consistent sanitization, logging or approval. A process intended to support resilience becomes an unmanaged path into the operational environment.
And that's the problem:
Trusting vendor routines without verifying them is not security. It’s exposure.
Composite Scenario: Persistent Vendor Access at a Power Plant
In a second generalized scenario, a power facility relies on third-party-maintained equipment. Vendor VPN access remains persistent, with limited session control, approval workflow and monitoring. In some cases, external users hold broader access than plant engineers.
When governance, service-level and remote-access questions have no accountable owner, the issue is not one supplier. It is an operating-model gap.
That’s not governance. That’s a blind spot.
The Real Problem: Trust Without Accountability
Let me be clear: vendors are critical to operations. But trusting them without control is what leads to trouble.
Especially when:
- The backup process is ad hoc and device-driven
- Remote access is always-on and unmonitored
- No one has reviewed the vendor's internal security policies
- There's no plan for what happens if the vendor experiences—or suspects—a breach
You might be ISO-certified, but if you've never asked your vendor how they enforce MFA, how they manage logs, or what their IR policy looks like, you're still exposed.
SLA Meets Cybersecurity
Service Level Agreements (SLAs) should be reviewed not from a legal or procurement angle, but through the lens of:
- Operational Resilience
- Remote Access Security
- Incident Response Alignment
- OT Cyber Risk
Whether your vendors comply with ISO 27001, 42001, or NIST CSF, we examine their access, protocols, and risk exposure, led by practitioners who have implemented and audited these controls in live operations.
We don't just deliver reports. We help redesign policies, securely onboard vendors, and help bring every access path into line with your operations, not their default configuration.
Questions You Need to Ask Right Now
- If you're depending on third parties—and you are—ask yourself:
- Has anyone on my team ever reviewed a vendor's cybersecurity policy?
- What would happen if this vendor were compromised?
- Do we have the ability to suspend access if they suspect a breach?
- Is remote access initiated and approved on-site?
- Can the vendor's session be audited, monitored, and recorded?
- Are our cybersecurity SLAs integrated with plant safety and continuity plans?
If the answer is "I don't know," you've already given up control.
Don't Trust Vendors. Trust Your Program.
Here is the lesson from both composite scenarios:
- A hard drive doesn't care if you're air-gapped.
- A VPN doesn't know who's behind the screen.
But your cybersecurity program should.
We’re not saying eliminate vendors—we're saying treat them as part of your operational risk landscape. Govern them. Monitor them. And design your system as if you might need to block them, even in the middle of a shift.
Security is not about trust. It's about control. Control over who can connect, what they can do, and how you recover when things go wrong.