If you look at the most devastating cyber-physical attacks of the last decade, a chilling pattern emerges. Adversaries are rarely breaking down the front door of the target organization. Instead, they are walking through the side door-a door left propped open by a trusted third-party vendor.
In the Operational Technology (OT) and Industrial Control Systems (ICS) world, vendor risk management (VRM) is broken. We treat original equipment manufacturers (OEMs), systems integrators, and maintenance contractors with implicit trust. We grant them remote VPN access to troubleshoot a 15-year-old Programmable Logic Controller (PLC), and then we completely forget that the connection exists.
According to recent industry data, 42% of manufacturers have experienced a breach via third-party or vendor access. Yet, over half of these organizations neglect to conduct pre-access reviews of those same vendors. Furthermore, the SANS 2025 State of ICS/OT Cybersecurity Survey highlighted that unauthorized external access accounted for a staggering half of all reported incidents.
Top 10 Vendor Audit Requirements in OT
1. Mandate OT-Specific Software Bill of Materials (SBOM)
A generic IT vendor might tell you their software is secure, but in OT, you need to know exactly what is inside the “black box.” Your audit must require vendors to provide a comprehensive Software Bill of Materials (SBOM) for all industrial hardware and software. If a new zero-day vulnerability drops for a specific open-source logging library, you need to know immediately if that library is embedded in your vendor’s SCADA software or edge gateways.
2. Audit the Vendor’s Remote Access Architecture (Zero Trust)
How exactly does the vendor connect to your plant floor to perform maintenance? If the answer is a persistent, always-on IPSec VPN directly into the control network, the vendor fails the audit. Demand that vendors align with Zero Trust Network Access (ZTNA) principles. They should only connect via an identity-aware proxy, granting them access only to the specific IP address of the machine they are servicing, for a tightly defined time window.
3. Require Independent OT Penetration Testing Reports
Do not accept self-attestation. If a vendor is supplying critical infrastructure equipment (like an RTU or a safety instrumented system), your audit must require them to submit reports from independent, third-party penetration tests. Crucially, these tests must evaluate the equipment in a simulated OT environment, testing for protocol vulnerabilities (e.g., Modbus or DNP3 manipulation) and resilience against denial-of-service (DoS) attacks that could crash the physical controller.
4. Evaluate Secure by Design (SbD) and Secure Development Lifecycle (SDLC)
Under the IEC 62443-4-1 standard, vendors must demonstrate a secure product development lifecycle. Your audit should interrogate how the vendor builds their products. Do they conduct threat modeling during the design phase? Do they strip out hardcoded default credentials before shipping? If a vendor treats security as a bolt-on patch rather than a foundational engineering principle, they introduce unacceptable risk to your operational technology.
5. Assess Vendor Incident Response and Breach Notification Times
When a vendor is compromised, the clock is ticking for your organization. Under strict new frameworks like the EU’s NIS2 Directive, essential entities have mere hours to report incidents. Your vendor audit and subsequent contracts must include strict Service Level Agreements (SLAs) for breach notification. If a vendor’s cloud analytics platform suffers a breach, they must be legally obligated to notify your SOC within 24 hours, providing full forensic transparency.
6. Scrutinize the Vendor’s Supply Chain (Fourth-Party Risk)
Your vendor is only as secure as their suppliers. This is fourth-party risk. Your audit must require vendors to map their own supply chains and demonstrate how they audit the companies supplying their microchips, firmware, and cloud hosting. If your trusted HVAC vendor outsources their remote monitoring software to a highly vulnerable, unvetted offshore company, that vulnerability is now sitting in your physical facility.
7. Audit Hardware and Physical Security Controls
In OT, cybersecurity is physical security. An audit should verify how a vendor secures the physical hardware before it reaches your loading dock. Do they use anti-tamper seals on logic controllers? Do they verify the cryptographic integrity of firmware upon boot? You must ensure that the hardware has not been intercepted and modified with a malicious payload (a classic supply chain interdiction attack) during transit.
8. Demand Robust Identity and Access Management (IAM) for Vendor Staff
You need to know who exactly is dialing into your water treatment plant. Your audit must verify the vendor’s internal IAM practices. Do they enforce Multi-Factor Authentication (MFA) for their own engineers? Do they conduct rigorous background checks on the personnel who hold the keys to your critical infrastructure? Furthermore, demand that vendors use uniquely identifiable accounts when accessing your systems, entirely banning shared “admin” or “support” credentials.
9. Require a Clear End-of-Life (EOL) and Patch Management Strategy
Industrial equipment routinely operates for 15 to 20 years, far outlasting typical IT lifecycles. Your audit must clarify the vendor’s long-term commitment. Ask explicitly: How long will you provide security patches for this controller? When a vulnerability is discovered, what is your guaranteed turnaround time for a patch? If the vendor cannot commit to a decade-plus support lifecycle or requires you to ship the physical unit back for updates, the operational risk is too high.
10. Enforce the “Right to Audit” Clause
Trust, but continuously verify. An initial onboarding questionnaire is useless if the vendor’s security posture degrades over the next three years. Every vendor contract must include a “Right to Audit” clause. This gives your organization the legal authority to conduct recurring assessments, request updated SOC 2 Type II or IEC 62443 certifications, and demand evidence that the vendor is continually maintaining their security controls against the evolving industrial threat landscape.
Conclusion
The illusion that the plant floor is isolated from the outside world is gone. Today, industrial control systems are deeply intertwined with third-party vendors, cloud analytics, and remote integrators. As attackers actively shift their focus toward exploiting these trusted relationships, utility operators and manufacturers must abandon polite, checkbox-style IT questionnaires. By enforcing rigorous, OT-native audit requirements-demanding SBOMs, enforcing Zero Trust access, and aggressively managing fourth-party risk-you can transform your vendor ecosystem from your greatest vulnerability into a heavily scrutinized, defensible perimeter.