What is access management?
Access management is the set of policies, processes and measures with which an organisation decides, records and monitors who may access which information, systems and physical spaces, and under what conditions, throughout the entire life of an account or access badge. It covers requesting, approving, granting, reviewing and revoking rights. Access management thereby protects the confidentiality, integrity and availability of the CIA Triad and makes actions traceable to a person. In OT environments it also determines who may operate, change or remotely reach an installation.
🧠 What is the difference between access management and access control?
The terms are often used interchangeably, but they describe different layers:
| Concept | Question | Example |
|---|---|---|
| Identity Management | Who is this person or system? | Creating an account in Active Directory when someone joins |
| Access management | Which rights does that identity get, who approves them and are they still correct? | Assigning the role Operator line 3 and reviewing it every year |
| Access Control | Is access allowed or denied right now? | The HMI refuses a setpoint change without an engineer role |
Access management is therefore the governance side: policy, processes and accountability. Access control is the technical enforcement in systems, networks and doors. Each needs the other. A perfectly designed rights model does not help if a PLC has no login, and strong technical control loses its value if nobody disables the accounts of people who leave.
🎯 Why is access management important?
| Reason | Explanation |
|---|---|
| Securing systems | Prevents unauthorised parties from viewing or changing sensitive or critical data |
| Accountability | Links actions to people or systems via identity management and logging |
| Compliance with standards | Required by BIO, ISO 27001, AVG, IEC 62443 and NIS2, among others |
| Limiting damage | Fewer rights mean less impact from a stolen account or ransomware |
| Security by Design | Access is safeguarded from the design stage rather than added afterwards |
Two well-known incidents show what goes wrong without sound management. At Colonial Pipeline, attackers got in during May 2021 through a legacy VPN account without MFA that was no longer in use but had never been disabled. In November 2023, the Cyber Av3ngers group gained access to a Unitronics PLC at a water authority in Aliquippa (United States) because the device was reachable from the internet and its default password was still in use.
🔧 What are the components of access management?
| Component | Description |
|---|---|
| Authentication | Confirming identity with a password, token, certificate or biometrics, preferably as MFA |
| Authorisation | Determining what someone may do: read, modify, delete, download |
| RBAC | Rights through a role that matches the job, such as operator or engineer |
| ABAC | Rights based on attributes of the user, object and environment, such as time, location, device or plant state |
| PAM | Extra control over administrator and engineering accounts with a vault, session recording and temporary access |
| Logging and auditing | Recording log-ons, changes and access requests for audits and investigations |
| Physical access | Badge systems, key management, visitor registration and camera surveillance |
🔄 How does the access lifecycle work?
Access management follows every identity from start to finish. In practice this is called the joiner-mover-leaver cycle:
- Request - a manager requests rights based on the job, not by copying the rights of a colleague.
- Approval - the owner of the system or data approves. For OT, this is preferably the person responsible for the installation, not IT alone.
- Provisioning - rights are granted through roles, with least privilege as the starting point.
- Change (mover) - when someone changes jobs, the old rights are removed. Otherwise rights accumulate, a well-known risk with long-serving staff.
- Review - owners periodically check whether all rights are still needed (recertification).
- Revocation (leaver) - when someone leaves or a contract ends, accounts, tokens, badges and VPN access are blocked immediately.
Common timescales in practice (not legal requirements):
| Activity | Typical timescale |
|---|---|
| Blocking on departure | No later than the last working day; immediately on summary dismissal |
| Review of privileged accounts | Every quarter |
| Review of regular accounts | Every six or twelve months |
| External supplier access | Per session or per assignment, with an end date |
| Check for dormant accounts | Monthly, for example blocking after 90 days of inactivity |
🔐 What are the best practices for access management?
- Least Privilege - access only to what is strictly needed for the task
- Segregation of duties - avoid conflicts of interest, for example by not giving administration and audit rights to the same person
- Multi-factor authentication (MFA) - mandatory for administration and for all access from outside
- Personal accounts - no shared accounts for administration or engineering, so that actions remain traceable
- Separate admin accounts - administrators use a normal account for daily work and a separate account for administrative tasks
- Replace default passwords - as soon as any device is commissioned, including PLCs, switches and cameras
- Periodic review - re-evaluate rights and record the outcome
The US agency CISA includes much of this in its Cross-Sector Cybersecurity Performance Goals: changing default passwords, unique credentials, revoking credentials of departing staff, MFA and separate user and privileged accounts.
🏭 How does access management work in an OT environment?
In OT, access management has historically been less strict. Many devices have no personal accounts, and in the control room an operator must be able to intervene immediately during an upset. IEC 62443-3-3 therefore takes as a principle that security measures must not block essential functions such as operation and safety.
| Application | Point of attention |
|---|---|
| SCADA and HMI | Personal logins for changes; shared station accounts only for viewing and operating, compensated by physical access control to the control room |
| PLC programming rights | Separation between operation and engineering; programming only from a managed engineering station |
| Remote access | Through a VPN and a jump server, with MFA, approval per session and session recording |
| Suppliers | Temporary, personal accounts; agreements recorded under supplier security |
| Physical access to field equipment | Badge control, locked cabinets, key management and camera surveillance |
| OT–IT interfaces | Network segmentation and access control at every crossing between zones |
IEC 62443-3-3 captures this in two of its seven foundational requirements. FR 1 Identification and authentication control includes SR 1.1 (human user identification and authentication), SR 1.3 (account management), SR 1.7 (strength of password-based authentication) and SR 1.13 (access via untrusted networks). FR 2 Use control starts with SR 2.1 (authorisation enforcement), with enhancements such as mapping permissions to roles. How strict the requirements are depends on the target security level of each zone.
📜 Which laws and standards require access management?
- ISO 27001:2022 - Annex A includes 5.15 (access control), 5.16 (identity management), 5.17 (authentication information), 5.18 (access rights), 8.2 (privileged access rights), 8.5 (secure authentication) and 7.2 (physical entry). Guidance is in ISO 27002.
- NIS2 - Article 21(2)(i) names access control policies and (j) the use of multi-factor or continuous authentication. In the Netherlands this is transposed into the Cybersecurity Act, in force since 15 August 2026. For digital service providers such as cloud and data centre operators, Implementing Regulation (EU) 2024/2690 adds detail, including periodic review of administrator accounts.
- BIO - the Dutch government information security baseline builds on ISO 27002 and applies to central government, provinces, municipalities and water authorities.
- AVG - the Dutch name for the GDPR; appropriate measures include ensuring that only authorised staff can see personal data.
- NIST SP 800-53 - the AC (Access Control) and IA (Identification and Authentication) control families, including AC-2 (account management), AC-5 (separation of duties) and AC-6 (least privilege). NIST SP 800-82 translates these to OT.
🧭 How do you set up access management step by step?
- Take inventory of systems, accounts and access paths, including forgotten VPN profiles, modems and local PLC accounts.
- Appoint owners per system or zone to approve and review rights.
- Design roles such as operator, maintenance technician, process engineer and supplier, each with minimal rights.
- Link to HR so that joining, changing jobs and leaving automatically trigger an action in access management.
- Harden privileged access with PAM, MFA and a single access route through a jump server.
- Log and monitor log-ons and changes, and forward anomalies to a SIEM.
- Document everything in the information security policy and test it periodically with an internal audit.
🔗 How does access management relate to other domains?
| Topic | Relationship with access management |
|---|---|
| Identity Management | Supplies the identity: who is who? |
| Information Security Policy | Defines rules for access and the rights structure |
| Incident Response Plan | Access logs are essential in incident investigation; blocking accounts is often a first step |
| Governance | Determines who may grant, change or revoke rights |
| Zero Trust | Every access request is revalidated, even inside the network |
| Insider Threat | Excessive or forgotten rights enable misuse by insiders |
| Compliance | Reviews and logs are the evidence for regulators and auditors |
❓ Frequently asked questions
What is the difference between access management and identity management?
Identity management establishes who a user or system is and manages the account. Access management determines which rights that identity receives, who approves them and whether they are still correct. Together they are often called Identity and Access Management (IAM).
How often should you review access rights?
ISO 27001 and NIS2 do not prescribe a fixed interval, but they do require access rights to be reviewed at planned intervals. In practice, privileged accounts are reviewed every quarter and regular accounts every six or twelve months. Record the outcome of each review as evidence for audits.
Is MFA mandatory under NIS2?
NIS2 lists the use of multi-factor or continuous authentication in Article 21 as one of the measures to apply where appropriate. For remote access and administrator accounts, MFA is therefore the expected norm. In the Netherlands this applies to essential and important entities through the Cybersecurity Act.
May control room operators use a shared account?
A shared station account for viewing and operating is common in OT, because intervening during an upset cannot wait for a log-in. For changes to setpoints, recipes or PLC programs, personal accounts are needed so that actions are traceable. Good access management compensates for shared accounts with physical access control to the control room and logging.
What is the difference between access management and PAM?
Access management covers all users and all rights in the organisation. Privileged Access Management (PAM) is a specialisation for accounts with elevated rights, such as administrators and engineers, adding measures such as a password vault, session recording and temporary access.
How do you manage access for external suppliers in OT?
Give suppliers personal, temporary accounts with an end date and have every session approved in advance. Route the access through a jump server with MFA and session recording, never through a permanent VPN or a modem of their own. Record the arrangements in the contract and revoke access as soon as the assignment is finished.
📌 In summary
Access management determines and monitors who may access information, systems and spaces under which conditions, from request to revocation. With roles, least privilege, MFA, periodic reviews and a strict leaver process, you avoid the forgotten accounts and default passwords that are the entry point for many incidents. In OT this calls for extra attention to shared stations, engineering rights and suppliers, as set out in IEC 62443, ISO 27001 and NIS2.