Checklist / CIS Controls v8.1

Who Can Remotely Reach Your Operational Systems?

Harris Ejiofor, CISM – CyberShield Advisory

Remote access keeps operations efficient, and it is also one of the most common ways in for attackers. A checklist for utilities and energy organizations.

Why this matters

Operators check readings from home. Vendors support their equipment from their own offices. Engineers fix problems at night without driving in. Each of those conveniences is a path into the systems that run your equipment, and attackers look for the paths nobody is watching. Mark each item yes, no or not sure, and treat not sure as no.

Know every path in

You have a written list of every way someone can connect remotely to operational systems, including old vendor connections.
Each connection has an owner and a reason it exists.
Nobody uses consumer remote-desktop or screen-sharing tools to reach operational computers.
Operational devices are not reachable directly from the internet.

Control who gets in

All remote access goes through one managed route, not several separate ones.
Every remote connection needs a second sign-in step.
Each person and each vendor has their own named account; nobody shares one.
Vendor access is switched off by default and turned on only for an agreed job and time.
Accounts for former staff and former vendors are removed promptly.

Watch and limit what they can do

Remote users can reach only the systems they need, not the whole operations network.
Remote sessions are logged, and someone reviews unusual ones.
You would notice a remote connection at an odd hour.

Be ready

Operators know how to cut remote access to operations quickly if something looks wrong.
The list of connections is reviewed at least once a year and after any vendor change.

What to do with your answers

If you could not list every remote path, start there; you cannot protect a door you do not know about. Then add a second sign-in step to every path, and switch vendor access to on-request only.

Take the next step

Our free NIST CSF 2.0 assessment asks five quick questions about who owns security, where sensitive data lives, sign-in, incident plans and tested backups, and gives an indicative result. It is a short check, not a formal rating.