OT Cybersecurity Best Practices for SMBs: Providing Third Party Access to the Operational Technology (OT) Network

This Dragos OT-CERT monthly blog provides practical OT cybersecurity guidance for small and medium businesses on vendor access and file-transfer practices: create and manage per-vendor user accounts with monitored, time-limited access; prohibit direct connection of vendor laptops or removable media to OT networks; stage and scan vendor files in the IT environment before moving them to dedicated OT USBs or laptops; and, where vendor-owned devices are required, restrict connectivity with cross-over cables or tightly-scoped firewall rules. The post also recommends documenting processes, training staff, using provided templates and toolkits, and promoting OT-CERT resources to improve supply-chain security posture.