# Identity for Manufacturing: OT Access, Machine Identity, and NIS2 Source: https://startwithidentity.com/articles/identity-for-manufacturing/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- Manufacturing identity is less about customer login and more about the plant floor. The hard questions are who and what can reach industrial control systems, through which path, with what rights, and whether that access is time-bound and recorded. Around that core sit a global workforce, a fleet of connected machines, and a supply chain of integrators and maintenance vendors who need remote access. See the [manufacturing vertical](https://startwithidentity.com/verticals/manufacturing/) page for the wider view. ## IT/OT convergence changes the threat model Plants used to be isolated. Today controllers, HMIs, historians, and engineering workstations connect to corporate networks for production data, to cloud services for analytics, and to vendors for remote support. Each connection is a path from an ordinary corporate credential to an industrial system. The practical consequence: identity and network design must be done together. A phished account should land in a corporate zone that has no route to the plant, and the only way into OT should be a brokered, authenticated, recorded session. [Microsegmentation](https://startwithidentity.com/glossary/microsegmentation/) and zone-based design limit where a compromised identity can go. Identity controls decide who may cross a boundary at all. Neither works alone. ## Privileged access to OT The classic manufacturing failure points are shared operator and engineering accounts, local credentials on engineering workstations, and default passwords on devices that were never expected to face a network. Good practice: - Named accounts for every engineer and operator, with [shared accounts](https://startwithidentity.com/glossary/shared-account/) limited to systems that cannot support anything else, and their use logged - A [PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/) gateway that brokers sessions into OT zones, vaults credentials, and records what happens - [Just-in-time access](https://startwithidentity.com/glossary/jit-access/) for specific assets and maintenance windows instead of standing rights - Tested [break-glass](https://startwithidentity.com/glossary/break-glass/) procedures, because a locked-out operator during a line stoppage is a safety issue, not only an inconvenience Some PAM vendors focus on industrial settings. [WALLIX](https://startwithidentity.com/vendors/pam/wallix/) has built a notable position in OT and industrial environments around bastion-style session management, per its profile. [CyberArk](https://startwithidentity.com/vendors/pam/cyberark/), acquired by Palo Alto Networks in February 2026 and rebranded Idira in May 2026, covers enterprise PAM broadly. Compare options in the [best PAM tools](https://startwithidentity.com/rankings/best-pam-tools/) ranking. ## Machine identity on the plant floor Robots, PLCs, sensors, gateways, and the software that talks to them increasingly authenticate to each other and to cloud services. These [non-human identities](https://startwithidentity.com/glossary/nhi/) often outnumber people, and they fail in a uniquely painful way: an expired certificate can halt a line as surely as an attack. Inventory every device and workload identity, issue [X.509](https://startwithidentity.com/glossary/x509/) certificates from a managed [PKI](https://startwithidentity.com/glossary/pki/), automate renewal, and remove hard-coded credentials from scripts and engineering projects. [Keyfactor](https://startwithidentity.com/vendors/pki/keyfactor/) is one certificate lifecycle platform whose profile notes support for private PKI and IoT use cases. The [machine identity fundamentals](https://startwithidentity.com/guides/fundamentals/what-is-machine-identity/) guide and the [best machine identity for enterprises](https://startwithidentity.com/rankings/best-machine-identity-for-enterprises/) and [best non-human identity security platforms](https://startwithidentity.com/rankings/best-non-human-identity-security-platforms/) rankings cover the tooling. ## Supply-chain and vendor access Integrators, OEM service engineers, and maintenance contractors need remote access to specific machines, often urgently. The anti-pattern is a permanent VPN account shared by a vendor's whole support team. Instead, give each external engineer a named, federated or sponsored identity, require MFA, broker the session through the PAM gateway to the specific asset, and expire access when the job ends. The [third-party access management practices](https://startwithidentity.com/articles/third-party-access-management-practices/) article covers the governance side. ## What NIS2 requires NIS2, [Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj), lists manufacturing in Annex II among "other critical sectors", covering medical devices, computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles, and other transport equipment. Article 21(2) sets the minimum risk-management measures, including (d) supply chain security, (i) human resources security, access control policies and asset management, and (j) the use of multi-factor authentication or continuous authentication solutions. Member States had to transpose the directive by 17 October 2024. See the [NIS2 regulation page](https://startwithidentity.com/regulations/european-union/nis2/) and the [identity controls for NIS2](https://startwithidentity.com/guides/compliance/identity-controls-for-nis2/) guide for the control mapping. ## What IEC 62443 adds The [ISA/IEC 62443 series](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards), developed by the ISA99 committee with IEC Technical Committee 65, is the reference for industrial automation and control system security. Its foundational requirements open with identification and authentication control and use control, and [part 3-3](https://www.isa.org/products/ansi-isa-62443-3-3-2013-security-for-industrial-au) defines system security requirements and security levels applied to zones and conduits. Part 2-4 sets requirements for service providers, which is where integrator access lands. For identity teams, the takeaway is concrete: unique identities and authenticated access for humans and devices, least privilege per zone, and controlled conduits between zones. ## Where to start 1. Map every path into OT: remote access tools, vendor VPNs, jump hosts, cloud connectors. 2. Put a brokered, MFA-protected, recorded path in front of each, and close the rest. 3. Replace shared engineering accounts with named ones wherever the system allows. 4. Inventory machine identities and automate certificate renewal before the next expiry stops a line. 5. Move supplier access to named, time-bound grants with periodic review. Workforce identity for the corporate side fits platforms such as [Microsoft Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/) or [Okta](https://startwithidentity.com/vendors/iam/okta/); the plant floor needs PAM, PKI, and segmentation designed together. In manufacturing, the measure of an identity program is simple: it stops intruders without stopping production.