What is Remote Maintenance?
Remote maintenance is the process by which technicians, engineers or suppliers use a network connection from another location to carry out maintenance, updates, Monitoring or fault analysis on industrial systems such as PLCs, HMIs and SCADA servers. The connection runs through a VPN, remote desktop, a web portal or an industrial Remote Access gateway supplied by the machine builder. Remote maintenance saves travel time and downtime, but it temporarily gives an outside party influence over a physical process.
In OT environments, remote maintenance makes it possible to respond to faults more quickly, but it also introduces risks of unauthorised access, misconfiguration and the introduction of Malware.
🧠 Why is remote maintenance used?
- Quick response time - no travel when there is an urgent fault; a specialist can look in within minutes instead of after a day on the road.
- Access to experts - the OEM or system integrator knows the machine best and can diagnose or configure it directly.
- Cost savings - fewer site visits and shorter production interruptions.
- Scalability - one team can support dozens of dispersed sites, such as pumping stations, wind farms or branch plants, from a central location.
- Efficient support - performing Firmware updates, parameter changes or control loop tuning remotely.
- Service models - condition monitoring and predictive maintenance delivered by the supplier require a permanent data connection.
🔄 What is the difference between remote maintenance and remote access?
Remote Access is the general term for any connection made from a distance. Remote maintenance is one application of it, with its own characteristics: the user is usually an external party, the session has a specific purpose and it often touches the control system directly.
| Aspect | Remote access | Remote maintenance |
|---|---|---|
| User | Own staff, suppliers, systems | Mainly suppliers, integrators and the in-house on-call team |
| Purpose | Administration, remote working, data retrieval | Fixing a fault, applying an update, changing configuration |
| Duration | Sometimes permanent | Should be temporary and approved per session |
| Impact | Varies | Often directly on the control system and the process |
Not every session carries the same risk. It helps to classify remote maintenance by what actually happens:
| Type | Example | Risk | Usual condition |
|---|---|---|---|
| Passive viewing | Looking at trends and alarms | Low | Read-only, preferably via a copy of the data |
| Diagnostics | Reading a diagnostic buffer or log files | Low to medium | Read-only rights, session logged |
| Active intervention | Changing a parameter or setpoint | High | Approval by the operator, who watches along |
| Program or firmware change | Downloading a new PLC program | Very high | Change management, backup, testing and a work permit |
🔧 Which techniques are used for remote maintenance?
| Technique | How it works | Point of attention |
|---|---|---|
| VPN via IDMZ and Jump Server | The tunnel ends in the DMZ and work is done from a hardened intermediate host | Secure as long as the VPN does not terminate directly inside the OT network |
| Industrial remote access gateway | Machine builder’s router with a cloud portal, for example Siemens SINEMA Remote Connect, HMS Ewon or Secomea | Often outside the view of in-house IT; agree who manages it |
| Remote support tools | TeamViewer, AnyDesk and similar tools via a cloud relay | Bypass firewalls and are often installed without oversight |
| RMM platforms | Remote Monitoring and Management by a service provider | One compromised platform affects every customer at once |
| Modem or ISDN | Dial-in connection to an installation | Outdated; no longer state of the art according to Germany’s BSI |
In its recommendation Fernwartung im industriellen Umfeld (BSI-CS 108, version 2.0 from 2018), the German BSI states that analogue and ISDN modems and PLCs connected directly to the internet no longer meet the state of the art. Modern solutions use an outbound connection from the installation, so no inbound ports need to be opened.
🔐 What risks does remote maintenance bring?
| Risk | Description |
|---|---|
| Insecure connections | Direct access to OT without encryption or strong authentication |
| Permanent access | Credentials remain valid outside working hours or without supervision |
| Shadow IT | Use of unapproved tools or private 4G routers by external technicians |
| Malware via laptops | External laptops or USB sticks bring viruses or ransomware with them |
| Shared accounts | One service password for all technicians, so nobody is individually accountable |
| Lack of logging | Activity is not recorded and no forensic trail is left |
| Lateral movement | An attacker uses the maintenance connection as a launchpad within the OT network |
Three incidents show how this goes wrong:
- Kaseya VSA (July 2021) - on 2 July 2021 the REvil ransomware group exploited a zero-day (CVE-2021-30116) in the VSA RMM platform and distributed ransomware disguised as an update. Fewer than 60 direct customers, mostly IT service providers, were hit, and through them up to around 1,500 downstream businesses.
- Colonial Pipeline (May 2021) - attackers got in through an unused but still active VPN account without MFA.
- Oldsmar (February 2021) - at a water treatment plant in Florida, the sodium hydroxide setpoint was raised via TeamViewer. Whether this was an intrusion or an employee error was later called into question, but the event shows how little control there was over who could operate the process through which tool.
✅ Which security measures are needed?
| Measure | Description |
|---|---|
| Jump Server | Shielded intermediate step with logging, inspection and authentication |
| MFA | Additional verification step for every external technician, with personal accounts |
| Time-window access | Access only during an approved window or via a work permit |
| Session recording and logging | Full audit trail of who did what |
| Anomaly detection | Detection of unusual behaviour during remote sessions |
| Least privilege | Technicians only get access to the system needed for their task |
| PAM | Passwords of administrator accounts kept in a vault and issued per session |
| Secure Remote Access tools | Industrial solutions with approval, recording and a kill switch for the connection |
📋 What do standards and legislation require of remote maintenance?
| Framework | Requirement | Meaning for remote maintenance |
|---|---|---|
| IEC 62443-2-4 SP.07 | Remote access by service providers | Suppliers must have secure, documented methods for remote access |
| IEC 62443-3-3 SR 1.13 and SR 2.6 | Access via untrusted networks, termination of sessions | Monitor and approve external access; close sessions automatically or manually |
| NIS2 Art. 21(2) | Access policy, MFA, supply chain security | Supplier connections fall under risk management |
| Cybersecurity Act | Dutch transposition of NIS2 (Cyberbeveiligingswet) | In force since 15 August 2026 |
| Machinery Regulation Annex III, 1.1.9 | Protection against corruption | From 20 January 2027 a machine must record legitimate and illegitimate interventions in safety-related software |
The US agency CISA also published a Guide to Securing Remote Access Software on 6 June 2023, together with the NSA, the FBI and others, aimed at both IT and OT. The guide describes how attackers abuse legitimate remote tools to get in, move laterally and stay undetected.
📦 How does remote maintenance in OT differ from IT?
| IT | OT |
|---|---|
| TeamViewer, RDP and VPN straight to the target system | Secured tunnels via a Jump Server or industrial gateway |
| Administrators often work independently within their rights | Access only after approval and with the operator’s knowledge |
| Standard operating systems with extensive logging | Proprietary HMIs and PLCs with limited logging capability |
| Endpoint protection and EDR on nearly every system | Antivirus often not possible on embedded systems |
| A mistake usually means data loss or downtime | A mistake can disturb the process or create an unsafe situation |
In OT environments, remote maintenance directly affects process safety and must be carried out under strictly controlled conditions.
🛠️ How do you organise remote maintenance step by step?
- Inventory all maintenance connections - look for VPN accounts, 4G routers in control cabinets, remote tools and modems. In practice you often find connections nobody remembers.
- Put agreements in the contract - personal accounts, MFA, incident notification, clean laptops and compliance with IEC 62443-2-4. See also Supplier Security.
- Choose one central route - via the IDMZ and a Jump Server or a secure remote access platform, and ban stand-alone tools.
- Set up a request process - the supplier requests a session, the process owner approves it for a fixed time window and the operator knows someone is connected.
- Supervise the session - recording on, the operator can always disconnect, and critical changes only happen with someone on site.
- Close properly - account disabled again, changes recorded through change management and a backup made of the new PLC program.
- Review periodically - check session logs, disable dormant accounts and revisit access rights.
Common working assumptions in practice (not normative values) are sessions of at most 4 to 8 hours, an inactivity timeout of 15 to 30 minutes and a quarterly review of all external accounts.
Example: a packaging line stops at night because of a servo fault. The on-call team asks the machine builder for help. The builder gets a four-hour session through the access platform, limited to the engineering station of that line. The operator sees the session on screen, the change to the drive parameters is recorded, and the next morning the engineer reviews the recording and enters the change in the change log.
❓ Frequently asked questions
Is remote maintenance safe for OT systems?
Remote maintenance is safe enough when the connection runs through one managed route, with personal accounts, MFA, approval per session and session recording. Remote maintenance becomes unsafe mainly through permanent connections, shared passwords and tools installed outside the administrator’s view.
May a machine builder install its own remote maintenance router in the control cabinet?
A machine builder’s router for remote maintenance is acceptable if it is under your control: connected via the IDMZ, with visible sessions and a way to switch the connection off. A router that opens its own 4G tunnel to the machine bypasses your segmentation and does not belong in a secured OT network.
Who is responsible for an incident during remote maintenance?
The owner of the installation remains responsible for security and safety, even when a supplier performs the remote maintenance session. Contractual agreements and session recordings do determine to what extent the supplier can be held accountable for a mistake.
Should the operator watch during remote maintenance?
For passive viewing or diagnostics, the operator usually does not need to watch continuously, provided the session is recorded. For changes to parameters, setpoints or PLC programs, the operator should know what is happening and be able to terminate the remote maintenance session.
Does remote maintenance fall under NIS2?
NIS2 does not mention remote maintenance literally, but it requires access policies, multi-factor authentication and management of supplier risks. For an organisation in scope, such as one covered by the Dutch Cyberbeveiligingswet, this means in practice that remote maintenance by suppliers must be demonstrably secured and logged.
Why is an RMM platform a risk?
An RMM platform for remote maintenance by definition has access to many systems at many customers at once. If the platform itself is compromised, as happened with Kaseya VSA in 2021, an attacker can reach every connected environment in one go.
📌 In summary
Remote maintenance is indispensable for fast supplier support, but it temporarily gives an outside party influence over a physical process and therefore requires strict security in OT. Access must be temporary, approved, restricted and fully logged, through one central route via the IDMZ and a Jump Server, with contractual agreements in line with IEC 62443-2-4. Technology and procedure matter equally.