Third-Party OT Access in Automotive Plants, How to Isolate Each Supplier Without Stopping Production

On an automotive line that several outside suppliers built and now service, each machine builder, integrator or equipment maker needs to reach its own machines and nothing else. Securing that third-party OT access, the supplier connections into the plant’s operational technology (OT), comes down to three design choices. Each supplier’s equipment gets a network segment of its own. Every supplier authenticates before connecting to anything, and its permissions depend on who signed in, so each one reaches only its assigned systems. Machine data reaches the plant on a separate path that supplier users cannot touch, which means walling suppliers off does not cost the plant its data.

How to Secure Third-Party OT Access When Suppliers Share One Line

Put each supplier in a network segment no other supplier can reach, make it authenticate before any connection opens, and limit it to the assets and scope of work it supports. Between segments, the DYNICS approach is deny by default, so traffic moves only along paths the plant has defined and everything else is refused. In that approach, the plant first sees which supplier reaches which machines, because it cannot control what it cannot see. The least-privilege part is federal guidance. A May 2025 fact sheet on primary OT mitigations from the Cybersecurity and Infrastructure Security Agency (CISA) and three partner agencies calls for remote access configured to least privilege “for the specific asset and user role or scope of work.”

The reason is what a flat network allows. Secure Connectivity Principles for OT, UK-led guidance co-authored by CISA, the FBI and other partners in January 2026, illustrates the risk with a flat OT network that gives vendors virtual private network (VPN) access. In that example, a contractor connecting to its own equipment “could also gain access to all other devices on the network.” Separately, CISA and partner agencies report in their April 2026 guide to zero trust principles for OT that threat actors have exploited “insecure and unrestricted remote access granted to vendors and operators to gain network access.”

Per-supplier segments map onto what ISA/IEC 62443 calls zones and conduits, which DYNICS covers in its guide to IEC 62443 zones and conduits. Their practical value is containment. According to the zero trust guide, segmentation limits the blast radius of an incident, so a single compromise is less likely to affect broader system functions. It also warns that segmentation alone is not foolproof without validation, access policy and monitoring.

What Agencies Recommend for Vendor Access and OT Remote Access

The National Institute of Standards and Technology (NIST) names vendors and system integrators doing maintenance among the reasons for OT remote access in SP 800-82r3, its OT security guide (September 2023). That ties third-party security in industrial control system (ICS) networks closely to remote access. The zero trust guide calls remote access “a major weakness in OT” because it is an initial access vector, while accepting that it may be necessary for operating distributed infrastructure. NIST adds that remote access must be controlled so unauthorized people stay out and authorized people cannot gain excessive access. Across these agencies, the recommended controls compare as follows.

The April guidance, which says any organization with OT can apply it, also sets a floor. Technical controls are preferred over manual ones, but “at minimum, a method must be in place that limits and monitors third-party access.” The January 2026 guidance adds that one central entry point allows the reuse of a single hardened access path across multiple vendors. That single path protects the plant only when each supplier’s reach behind it stays narrow. In a shared production environment, narrow reach means per-supplier segments.

Isolating Suppliers Without Losing Uptime or Machine Data

If tightening third-party OT access at your plant has meant slower support, workarounds and change windows that interrupt production, skepticism about doing it again is fair. NIST explains why plants are right to be cautious. Many OT processes run continuously, unexpected outages are unacceptable, and outages often have to be scheduled days or weeks in advance. OT systems often cannot be stopped and started without affecting production, and applying information technology (IT) security practices to OT indiscriminately can cause availability and timing problems.

So the isolation has to be designed around the line. NIST recommends that owners grouping assets into zones consider how the zone and isolation design affects day-to-day operations, safety and response capabilities. It also asks that operations personnel know about planned remote activity during temporary remote access. DYNICS covers the same problem at the IT and OT boundary in its guide to separating OT from IT without stopping production.

Isolation also changes what a bad day looks like. The January 2026 guidance describes a third party with remote access that has been compromised. Where secure connectivity and network controls are in place, a well-architected just-in-time access model lets the plant revoke that party’s access temporarily while the other third parties stay connected. Once the risk has been mitigated, the disabled connection is re-enabled.

Suppliers keep what they need, and so does the plant. A supplier’s users need a path to that supplier’s machines. The plant’s data collection needs a path to every supplier’s machines, and that path can stay out of reach of every supplier login. The automotive plant below built both.

How One Automotive Plant Walled Off Eight Suppliers and Kept Its Data

A major automotive manufacturing facility had eight independent suppliers supporting the process in a shared production environment. According to the DYNICS case study, it required strict network isolation, secure access control, centralized data collection and real-time operational visibility. It also needed third-party OT access that kept each supplier out of the other suppliers’ networks and equipment and made every supplier authenticate before connecting to any system. Those controls had to work without affecting operational visibility or production workflows.

DYNICS implemented ICS360.Defender, its OT firewall with deep packet inspection, alongside industrial switching infrastructure to isolate each supplier network and control user access. With ICS360.Defender’s dynamic rules, access permissions changed on their own according to which supplier had authenticated. Once logged into a DYNICS EW integrated industrial workstation, suppliers could access only their assigned systems and devices. DYNICS reports that this provided secure segmentation between supplier networks, prevention of unauthorized lateral movement, role-based access to approved systems only and centralized authentication before network access.

Plant data stayed on its own path. ICS360.Fusion maintained secure communication with supplier systems for centralized data collection while remaining isolated from supplier-level user access. During active production it powered live dashboards on a 55-inch overhead monitor in the production area, showing machine states, equipment activity, supplier system status and overall process conditions. When the line went idle, ICS360.Fusion opened a web browser and played a video of the process on the same monitor, then returned to the live dashboards once production resumed. Among the outcomes DYNICS lists are secure isolation of eight independent supplier networks and centralized OT data collection with enterprise integration.

Common Questions About Third-Party Access to OT Systems

How do you secure third-party supplier access to OT systems?

Start with one segment per supplier, authentication first and least-privilege permissions for each. The May 2025 CISA fact sheet pairs least privilege with disabling dormant accounts. For monitoring, a 2021 National Security Agency advisory on connected OT, written for National Security System, Department of Defense and defense industrial base owners, advises logging all access attempts. It names vendor support, including vendor laptops with remote monitoring connections, as an access vector.

What is multi-supplier OT network segmentation?

It divides one shared production network so each supplier’s machines sit in their own segment, with traffic between segments limited to defined, enforced paths. In ISA/IEC 62443 terms, each segment can be a zone. The ISA Global Cybersecurity Alliance’s quick start guide to ISA/IEC 62443 describes a zone as a grouping of assets based on risk or other criteria, including required access and the responsible organization. ISA’s glossary defines a conduit as a logical grouping of communication channels connecting two or more zones that share common security requirements.

How can manufacturers isolate supplier networks without interrupting production?

The automotive plant above required strict OT cybersecurity controls that would not affect operational visibility or production workflows, and DYNICS reports that the finished OT environment supported multiple independent suppliers while maintaining visibility and operational efficiency. There, ICS360.Defender worked alongside industrial switching infrastructure to isolate each supplier network, and DYNICS says the firewall learns the network’s traffic itself to simplify secure setup. NIST lists switches, routers, firewalls and unidirectional gateways among the network devices that can enforce segmentation and isolation, and it warns that applying IT security practices to OT indiscriminately can cause availability and timing problems.