Identity for Manufacturing: OT Access, Machine Identity, and NIS2

Manufacturing identity is less about customer login and more about the plant floor. The hard questions are who and what can reach industrial control systems, through which path, with what rights, and whether that access is time-bound and recorded. Around that core sit a global workforce, a fleet of connected machines, and a supply chain of integrators and maintenance vendors who need remote access. See the manufacturing vertical page for the wider view.

IT/OT convergence changes the threat model

Plants used to be isolated. Today controllers, HMIs, historians, and engineering workstations connect to corporate networks for production data, to cloud services for analytics, and to vendors for remote support. Each connection is a path from an ordinary corporate credential to an industrial system. The practical consequence: identity and network design must be done together. A phished account should land in a corporate zone that has no route to the plant, and the only way into OT should be a brokered, authenticated, recorded session.

Microsegmentation and zone-based design limit where a compromised identity can go. Identity controls decide who may cross a boundary at all. Neither works alone.

Privileged access to OT

The classic manufacturing failure points are shared operator and engineering accounts, local credentials on engineering workstations, and default passwords on devices that were never expected to face a network. Good practice:

• Named accounts for every engineer and operator, with shared accounts limited to systems that cannot support anything else, and their use logged
• A PAM gateway that brokers sessions into OT zones, vaults credentials, and records what happens
• Just-in-time access for specific assets and maintenance windows instead of standing rights
• Tested break-glass procedures, because a locked-out operator during a line stoppage is a safety issue, not only an inconvenience

Some PAM vendors focus on industrial settings. WALLIX has built a notable position in OT and industrial environments around bastion-style session management, per its profile. CyberArk, acquired by Palo Alto Networks in February 2026 and rebranded Idira in May 2026, covers enterprise PAM broadly. Compare options in the best PAM tools ranking.

Machine identity on the plant floor

Robots, PLCs, sensors, gateways, and the software that talks to them increasingly authenticate to each other and to cloud services. These non-human identities often outnumber people, and they fail in a uniquely painful way: an expired certificate can halt a line as surely as an attack. Inventory every device and workload identity, issue X.509 certificates from a managed PKI, automate renewal, and remove hard-coded credentials from scripts and engineering projects. Keyfactor is one certificate lifecycle platform whose profile notes support for private PKI and IoT use cases. The machine identity fundamentals guide and the best machine identity for enterprises and best non-human identity security platforms rankings cover the tooling.

Supply-chain and vendor access

Integrators, OEM service engineers, and maintenance contractors need remote access to specific machines, often urgently. The anti-pattern is a permanent VPN account shared by a vendor's whole support team. Instead, give each external engineer a named, federated or sponsored identity, require MFA, broker the session through the PAM gateway to the specific asset, and expire access when the job ends. The third-party access management practices article covers the governance side.

What NIS2 requires

NIS2, Directive (EU) 2022/2555, lists manufacturing in Annex II among "other critical sectors", covering medical devices, computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles, and other transport equipment. Article 21(2) sets the minimum risk-management measures, including (d) supply chain security, (i) human resources security, access control policies and asset management, and (j) the use of multi-factor authentication or continuous authentication solutions. Member States had to transpose the directive by 17 October 2024. See the NIS2 regulation page and the identity controls for NIS2 guide for the control mapping.

What IEC 62443 adds

The ISA/IEC 62443 series, developed by the ISA99 committee with IEC Technical Committee 65, is the reference for industrial automation and control system security. Its foundational requirements open with identification and authentication control and use control, and part 3-3 defines system security requirements and security levels applied to zones and conduits. Part 2-4 sets requirements for service providers, which is where integrator access lands. For identity teams, the takeaway is concrete: unique identities and authenticated access for humans and devices, least privilege per zone, and controlled conduits between zones.

Where to start

1. Map every path into OT: remote access tools, vendor VPNs, jump hosts, cloud connectors.
2. Put a brokered, MFA-protected, recorded path in front of each, and close the rest.
3. Replace shared engineering accounts with named ones wherever the system allows.
4. Inventory machine identities and automate certificate renewal before the next expiry stops a line.
5. Move supplier access to named, time-bound grants with periodic review.

Workforce identity for the corporate side fits platforms such as Microsoft Entra ID or Okta; the plant floor needs PAM, PKI, and segmentation designed together. In manufacturing, the measure of an identity program is simple: it stops intruders without stopping production.