A supplier needs to diagnose a fault on a CNC machine at 3pm. Production is behind, an order is due tomorrow and the original engineer is not available on site. Secure supplier remote access can get the right person onto the system quickly without leaving a permanent, poorly controlled route into your factory network.
The key is to treat supplier access as a production dependency, not an informal IT favour. A remote connection may be essential for machinery support, ERP troubleshooting, CAD licence issues or warehouse equipment. But if it is unmanaged, it can expose production systems, intellectual property and the wider business to unnecessary risk.
Why supplier access needs tighter control
Many manufacturers inherit remote-access arrangements over time. A machine installer sets up a remote support tool. An ERP partner is given an administrator account. A controls specialist has a VPN login that remains active years after the commissioning project ends. None of this looks alarming during a busy week. Together, however, these arrangements create a route into systems that may be difficult to monitor or shut down.
The risk is not that every supplier will act carelessly. Most want to resolve faults quickly and protect their own reputation. The issue is that their account, laptop or support platform could be compromised. An attacker does not need to break through every layer of your defences if they can use a trusted supplier connection instead.
For a manufacturer, the consequences go beyond disrupted office work. A compromised engineering workstation can expose drawings. Unauthorised access to an ERP or MRP system can affect stock, schedules and purchasing. An infection spreading from an office network to a machine-connected computer can halt a production cell. The resulting delay can mean missed deliveries, overtime and difficult conversations with customers.
Secure supplier remote access starts with a clear decision
Not every supplier needs the same level of access. Start by deciding what each party genuinely needs to do, when they need to do it and which systems they need to reach.
A supplier supporting a packaging line may only need access to one engineering computer during an agreed support session. Your ERP provider may need temporary access to a test environment and, occasionally, supervised access to production. A managed IT provider may need broader access, but still should not rely on shared administrator credentials.
This distinction matters because the most convenient arrangement is often far wider than necessary. Giving a third party access to the whole network because they need to inspect one controller is like handing over keys to every unit because someone needs to service a single door.
Create a simple supplier access register. It should record the supplier, named users, systems accessed, business reason, method of connection, approval owner and date of the next review. This is useful operationally as well as for customer security questionnaires, Cyber Essentials preparation and cyber insurance discussions.
Use controlled access, not permanent open doors
The strongest practical approach is to make supplier access named, limited and time-bound. Each engineer should use their own account, protected by multi-factor authentication. Shared usernames make it impossible to see who connected, and they tend to survive long after staff or contracts change.
Where possible, access should be enabled only for an agreed session and removed afterwards. This can be managed through a remote-access platform, privileged access management tool or a well-controlled VPN process. The technology matters, but the operating process matters just as much: someone must know who approves access and who checks that it has ended.
A good arrangement normally includes the following controls:
- Named accounts for individual supplier engineers, never a generic supplier login.
- Multi-factor authentication, using an authenticator app or other suitable second factor.
- Access limited to the required device, application or network segment.
- Session logging so you can see when access was used and, where appropriate, record activity.
- A clear approval process for urgent and planned connections.
- Regular reviews, with accounts removed promptly when support contracts or personnel change.
There is a trade-off. Requiring approval can add a few minutes when an urgent fault occurs. For systems where downtime is expensive, agree an emergency process in advance. For example, the production manager may approve access by phone, while IT enables a limited session and records the reason afterwards. That is faster than discovering an old account cannot be traced during an incident.
Keep production networks separate from business systems
Network segregation is particularly important in factories and workshops. It means separating systems into controlled areas so that a problem in one area is less likely to spread into another.
At a minimum, consider separate network segments for office devices, servers, warehouse scanners and printers, guest Wi-Fi, and operational technology such as machinery-connected computers and industrial controllers. Supplier access should terminate in a tightly controlled area, rather than placing an external engineer directly onto the general company network.
The right design depends on the machinery and its support requirements. Some older equipment was installed with remote support in mind but has no modern security features. Others rely on unsupported operating systems or proprietary software that cannot simply be patched without vendor testing. Replacing or updating it may create operational risk, particularly where a production line has limited maintenance windows.
In these cases, isolation can reduce risk without pretending the device is modern. Place the equipment on its own segment, tightly restrict communication to necessary systems and provide supplier access through a controlled jump device. A jump device is a dedicated, managed computer that suppliers connect to first. From there, they can reach only the approved machine or application.
This is not a substitute for a long-term replacement plan. It is a sensible control while you work around operational constraints, vendor limitations and capital planning.
Protect the accounts and devices around the connection
Remote access security is only as strong as the accounts and devices involved. If a supplier logs in from an unmanaged personal laptop, you have limited visibility of whether it is patched, encrypted or protected from malware. You may not be able to dictate every aspect of a supplier’s IT, but you can set proportionate contractual and technical expectations.
Ask critical suppliers how they protect remote-support accounts, whether they use multi-factor authentication, how they manage their own devices and how they notify customers of a security incident. For higher-risk access, require connection through your approved remote-support platform rather than allowing an unfamiliar tool to be installed on a production computer.
Your own environment also needs attention. Keep remote-access software updated, remove local administrator rights where they are not needed and monitor failed sign-in attempts. Ensure backups cover critical configurations, ERP data and other systems needed to restart operations. Backups should be protected from routine user access and tested through actual restores. A backup that has never been restored is a hopeful theory, not a recovery plan.
Build remote support into supplier management
Secure supplier remote access works best when IT, operations and procurement share responsibility. Operations understands the cost of downtime and when access may be needed. IT understands the network, identities and monitoring. Procurement or leadership can make the access requirements part of supplier selection and contract renewal.
For a new machine, ask remote-access questions before purchase and commissioning. Who needs access? What software will be installed? Can access be restricted to named users? Does the supplier require a permanent VPN, or will supervised remote sessions work? Can the system be segmented without affecting support? These questions are far easier to answer before the machine is on the factory floor and required for next week’s output.
For existing suppliers, start with the highest-risk and highest-impact connections. Focus first on accounts with broad access, systems containing sensitive designs or commercial data, and machinery-connected devices that are difficult to replace. You do not need to redesign everything at once, but you do need a documented plan and an owner for each action.
A practical next step for your site
Review every route that allows a supplier to connect remotely, including VPN accounts, remote desktop tools, machine vendor portals and accounts held by former contractors. If you cannot quickly answer who has access, what they can reach and when it was last reviewed, you have found the first problem to solve.
For manufacturers across Hampshire, Surrey and West Sussex, Syn-Star can assess supplier access alongside network segregation, legacy equipment risk and recovery planning. The aim is not to slow down essential support. It is to make sure a request for help with one machine does not become an uncontrolled route into the rest of the business.
