# Vendor and remote-access management

Evaluate identity, target, duration, local sponsorship and session evidence rather than treating a VPN as sufficient.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Own the access need

A Harbor vendor requests remote maintenance support. Define the target asset, business purpose, individual identity and duration. Trusting a supplier company does not authorize every employee for every system. The local sponsor owns process context and maintenance readiness. Shared accounts make review harder; associate individual identity with access records. The policy also addresses contracts, third-party lifecycle, departing personnel and ended services. This exercise supplies no real connection address or credentials. A complete request supports review but does not itself establish that the requested session should be opened.

## Jump path and session boundary

Enterprise identity, strong authentication, a controlled jump point and target-specific authorization complement each other. A VPN alone limits neither targets nor onward movement. Harbor records the access window, target list, permitted work, session oversight and closure check separately. The authorized team defines recording and retention under applicable policy; indefinite collection of every screen is not a default answer. Network reachability does not grant application or process-command authority. Actual session establishment and termination procedures are outside this local model. Review the entire chain rather than one gateway indicator.

## Govern emergency access too

An emergency label does not remove local authorization. If the normal channel fails, use a previously designed emergency-access process with an authority owner, alternative communications and retrospective review. Consider how revocation affects process support; automatic disconnection is not universally safe. In Harbor, learners seek an owner, duration, impact review and revocation/review plan. The model opens and ends no real session. Relevant operating and safety authorities determine what action is appropriate at a real site, including dependencies that a generic identity workflow cannot know.

## Use a reference architecture appropriately

NIST SP 1800-45 provides remote-access examples for water and wastewater utilities. Those examples are not pre-approved designs for another factory. Evaluate the supported identity technology, latency and availability needs, vendor constraints and local operating model. Harbor workpapers separate architectural assumptions, available evidence and missing validation. Access reviews include contract and role-change triggers alongside periodic review. The result identifies which access was reviewed, by whom and with what evidence, instead of assigning a generic secure label. References support discussion; site-specific decisions still require appropriate owners.

## Working sequence

1. Identify request, individual and local sponsor.
2. Scope target, purpose and duration.
3. Request identity and jump-path evidence.
4. Review emergency and closure conditions.
5. Assign the time-bound follow-up review.

## 1. Is a VPN sufficient?

A VPN indicator establishes no individual identity, MFA evidence or local sponsorship. Without these links, who accessed which process remains unclear; complete the access review.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.vpnEnabled === true
```

### Corrected implementation
```js
s => s.vpnEnabled === true &&
  s.namedIdentity === true &&
  s.mfaEvidence === true &&
  s.localSponsor === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "vpnEnabled": true,
        "namedIdentity": true,
        "mfaEvidence": true,
        "localSponsor": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-namedIdentity",
      "input": {
        "vpnEnabled": true,
        "namedIdentity": false,
        "mfaEvidence": true,
        "localSponsor": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-localSponsor",
      "input": {
        "vpnEnabled": true,
        "namedIdentity": true,
        "mfaEvidence": true,
        "localSponsor": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "vpnEnabled": true,
        "namedIdentity": true,
        "mfaEvidence": true,
        "localSponsor": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-namedIdentity",
      "input": {
        "vpnEnabled": true,
        "namedIdentity": false,
        "mfaEvidence": true,
        "localSponsor": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-localSponsor",
      "input": {
        "vpnEnabled": true,
        "namedIdentity": true,
        "mfaEvidence": true,
        "localSponsor": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Open-ended maintenance ticket

A ticket does not justify unlimited duration or targets. Document time limits, target scope and session review together; ticket counts do not establish access-control effectiveness.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.ticketExists === true
```

### Corrected implementation
```js
s => s.ticketExists === true &&
  s.timeBoxed === true &&
  s.targetScoped === true &&
  s.sessionReviewed === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "ticketExists": true,
        "timeBoxed": true,
        "targetScoped": true,
        "sessionReviewed": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-timeBoxed",
      "input": {
        "ticketExists": true,
        "timeBoxed": false,
        "targetScoped": true,
        "sessionReviewed": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-targetScoped",
      "input": {
        "ticketExists": true,
        "timeBoxed": true,
        "targetScoped": false,
        "sessionReviewed": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "ticketExists": true,
        "timeBoxed": true,
        "targetScoped": true,
        "sessionReviewed": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-timeBoxed",
      "input": {
        "ticketExists": true,
        "timeBoxed": false,
        "targetScoped": true,
        "sessionReviewed": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-targetScoped",
      "input": {
        "ticketExists": true,
        "timeBoxed": true,
        "targetScoped": false,
        "sessionReviewed": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Emergency exception

Emergency access cannot bypass site authority and physical-impact review. Name the post-use revocation/review owner too; the model does not recommend disconnecting a real connection.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.emergencyDeclared === true
```

### Corrected implementation
```js
s => s.emergencyDeclared === true &&
  s.siteAuthority === true &&
  s.impactReviewed === true &&
  s.revokeAndReview === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "emergencyDeclared": true,
        "siteAuthority": true,
        "impactReviewed": true,
        "revokeAndReview": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-siteAuthority",
      "input": {
        "emergencyDeclared": true,
        "siteAuthority": false,
        "impactReviewed": true,
        "revokeAndReview": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-revokeAndReview",
      "input": {
        "emergencyDeclared": true,
        "siteAuthority": true,
        "impactReviewed": true,
        "revokeAndReview": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "emergencyDeclared": true,
        "siteAuthority": true,
        "impactReviewed": true,
        "revokeAndReview": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-siteAuthority",
      "input": {
        "emergencyDeclared": true,
        "siteAuthority": false,
        "impactReviewed": true,
        "revokeAndReview": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-revokeAndReview",
      "input": {
        "emergencyDeclared": true,
        "siteAuthority": true,
        "impactReviewed": true,
        "revokeAndReview": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Access request naming individual, target, sponsor, window and evidence.
- Closure, exception and retrospective-review record.

## References

- [NIST SP 800-82 Rev.3 · Final September 2023](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [NIST SP 1800-45 · Water/wastewater remote-access example architectures · Final June 2026](https://csrc.nist.gov/pubs/sp/1800/45/final)