What is a best practice for auditing third-party remote maintenance on OT systems?

What is a best practice for auditing third-party remote maintenance on OT systems?

• A. Sharing credentials publicly.
• B. Allowing unchanged access.
• C. Logging unnecessary.
• D. Logging all activities for audit.

Answer: (D)

Auditing third-party remote maintenance on OT systems hinges on creating a complete, tamper-evident record of every action performed by external operators. In operational technology environments, changes to controllers, networks, or configurations can affect safety and reliability, so you need to know exactly who connected, when, from where, and what they did. Logging all activities provides full visibility, supports post-incident forensics, enables compliance checks, and helps verify that maintenance was authorized and conducted within policy. It also allows you to detect unusual or privileged actions and to review activity during audits. To be effective, these logs should be protected against tampering, stored securely, retained for an appropriate period, and reviewed regularly. The other practices compromise security: sharing credentials publicly removes accountability; allowing unchanged access means ongoing, untracked access; logging only what seems necessary can miss critical events that are essential for a complete audit trail.

Auditing third-party remote maintenance on OT systems hinges on creating a complete, tamper-evident record of every action performed by external operators. In operational technology environments, changes to controllers, networks, or configurations can affect safety and reliability, so you need to know exactly who connected, when, from where, and what they did. Logging all activities provides full visibility, supports post-incident forensics, enables compliance checks, and helps verify that maintenance was authorized and conducted within policy. It also allows you to detect unusual or privileged actions and to review activity during audits. To be effective, these logs should be protected against tampering, stored securely, retained for an appropriate period, and reviewed regularly. The other practices compromise security: sharing credentials publicly removes accountability; allowing unchanged access means ongoing, untracked access; logging only what seems necessary can miss critical events that are essential for a complete audit trail.