Vendor remote access should provide the minimum approved capability needed for support, with customer ownership and a clear end to the session or authorization. Coordinate the process across security providers, manufacturers, and customer IT.
Part of Enterprise Physical Security Cybersecurity Coordination.
Approve support access and its limits
Define who requests access, who approves it, the systems in scope, permitted actions, duration, and the record of activity required. Use the customer’s approved authentication and connection methods. Separate a support role from unrestricted customer administration and document any platform limitation.
Plan urgent support and access exceptions
Plan urgent support, unavailable approvers, subcontractors, dormant accounts, and manufacturer escalation. Permanent shared credentials can make ownership and accountability difficult. Establish a reviewed exception process where temporary access cannot be implemented as intended, including a limit and subsequent review.
Test expiry, logging, and customer control
Demonstrate approved access, scope restrictions, logging where supported, expiry or revocation, and customer recovery of control. Test the support workflow before an outage creates urgency. Review access after provider changes and significant service work, using the customer’s established process.
Related planning resources
- Cybersecurity & Data Protection Standards
- Network Security for Security Systems | VPN & Parallel Infrastructure
Frequently Asked Questions
What access should a security vendor receive for remote support?
Provide the minimum approved capability needed for the support task, with clear limits and customer ownership. Define who may connect, what they may reach, and when the authorization or session ends. Coordinate the arrangement with customer IT.
How should vendor remote-access controls be verified?
Test expiry, logging, and customer control of the approved access. Include urgent-support exceptions in the process. A support connection should remain accountable after the initial setup.
Let’s talk about your next step
Tell us what you want to improve and which locations are involved. We can help you work through the questions, check what your systems support, and define a practical project scope.
Compliance, Codes & Project Standards
NERSA plans commercial and industrial security work with applicable code, documentation, inspection and authority-having-jurisdiction requirements in mind. Requirements vary by system, property and jurisdiction. These resources support project planning; they do not establish legal compliance, certification or AHJ approval.
Related guidance: Regulatory compliance & inspection readiness · NERSA project standards · Documentation, testing & inspection readiness