The False Choice of NERC CIP-003-9: Keep Remote Access and Stay Compliant

When the new regulations took effect, compliance officers and operations teams found themselves at an impasse. The mandate demands granular visibility and strict control over who accesses what. Legacy tools simply cannot provide the necessary audit trails. A traditional VPN connects a user to a network, not a specific resource, meaning your audit log is essentially a wide-open door. Swiss cheese would be jealous of the gaps in traditional perimeter defence.

This technical friction led to a brutal operational shift. To eliminate the risk, many independent power producers simply severed the connection. Vendors who previously monitored PLCs remotely were suddenly locked out. Routine maintenance that used to take five minutes now requires a physical truck roll. This severely impacts your mean time to repair and introduces unnecessary physical friction into your digital processes. You mitigated the cyber risk, but you amplified the operational risk.

It does not have to be this way. Organizations like the National Institute of Standards and Technology outline clear supply chain risk management practices that do not require severing connectivity. By implementing a Zero Trust architecture you authenticate the user, verify their context, and grant access only to a single specific resource, all while generating an immutable, perfectly granular audit trail.

Attend this webinar if you:

• Manage remote access for third-party vendors and contractors.
• Have an operations team frustrated by the overcorrection to NERC CIP-003-9.
• Are responsible for maintaining regulatory compliance without destroying operational technology workflows.

What you will learn:

• How to reverse the sunsetting of remote tools and safely restore vendor access.
• The method for maintaining existing workflows while satisfying auditors.
• Why you can have remote access and compliance simultaneously, rather than picking just one.

We invite you to read our detailed white paper on why legacy remote access tools are not sufficient, and then join us to learn how to build a resilient, compliant access strategy. If you want to discuss your specific architecture beforehand, you can book a 15-minute consultation with our engineering team.