Unlike office and building IT, OT remote maintenance access has a very large potential user base outside the organisation operating the OT. At the same time, the uninterrupted availability of real-time data in an ICS is essential, while the availability of office and building IT data is usually somewhat less time-critical. General rules on how remote access is used for office and building IT are often inappropriate for OT or allow for too much ambiguity.

If the use of OT remote maintenance access is not adequately regulated in a contract, it can lead to a lack of clear specifications on how the users of each individual access point are to be restricted. The operator then cannot control who uses its OT remote maintenance access points. For example, access data used by integrators, manufacturers, and maintenance service providers can be passed on to users who are unknown to the operator. An ICS cannot tolerate such a risk.

If restrictive usage regulations specific to OT are insufficient, the operator cannot adequately control how remote maintenance access to the OT is used. In the event of a security incident, for example, forensic analysis is then made more difficult because causes cannot be identified quickly enough. This can prolong costly production downtime.

If OT remote maintenance access is provided and operated jointly with or by office and building IT and this joint use of the access hardware or software is not clearly regulated, it can lead to inconsistent configurations. This can result in configurations that meet the security requirements of office and building IT, but not the divergent or additional security requirements of OT.