Soffid Solutions for Industry:

The safe path is read/monitor-first — connecting to OT identity and access data (who has accounts, what they can do) without deploying new agents onto plant equipment or changing configurations that touch production, then layering certification and policy on top of what's discovered. Any change that does need to touch OT systems directly should go through the same maintenance-window and change-control process production changes already require, rather than being pushed through as a standard IT rollout, since plant downtime risk is the actual blocker, not the governance concept itself.

The practical fix usually isn't replacing the shared account the vendor requires for support — it's putting a privileged access management layer in front of it, so individual technicians check out the shared credential through a system that logs who used it and when. This satisfies both the vendor's support requirement for a single account and the internal need for individual attribution, avoiding renegotiation of vendor support agreements while still closing the accountability gap a bare shared login leaves.

This access should go through the same PAM discipline as any privileged remote session: time-limited connections granted for a specific maintenance window, tied to an identified individual rather than a shared vendor account, routed through a jump host or broker rather than a direct line into the OT network, and fully logged. The common failure mode — a standing VPN or modem connection with a shared credential and no MFA — is exactly what this replaces, without requiring the vendor to change how their technicians work day to day.

Yes, because true air-gapping is rarer in practice than assumed — USB transfers, dual-homed maintenance laptops, and contractor devices routinely cross the gap, and each of those crossing points is an identity and access event that can be governed even if the OT network itself has no live connection to IT. The relevant control isn't remote identity federation into the air-gapped system — it's governing who is authorized to be the bridge (which technician, which laptop, which USB device) and logging that boundary-crossing access, since that's where the actual risk sits.

Equipment that can't run a modern security agent still has an access control point somewhere — a login prompt, an engineering workstation, a network switch port — and governance can attach there instead of on the device itself, typically by controlling and logging access to the systems used to reach the equipment rather than the equipment's own decades-old authentication. Industry estimates that roughly half of fielded OT assets are 15+ years old make this the norm rather than the exception in manufacturing, so treating it as a special case rather than the default is usually the wrong framing.

The safer pattern is a one-way or tightly filtered trust — OT systems can reference IT identity data for governance and reporting purposes without giving IT-side credentials direct authentication rights into OT, keeping the two directories logically connected for oversight while maintaining a hard boundary against lateral movement. Poorly done convergence — a shared, bidirectionally-trusted directory — is exactly what turns identity into a new attack path between the two environments, so segmentation of the trust relationship matters as much as the integration itself.

In practice this needs an explicit, documented split rather than an assumed default: operations/engineering typically owns the decision of who should have access to a given line or machine, since they understand the operational risk, while corporate IT security owns the platform, policy enforcement, and audit trail that decision runs through. A governance tool needs to support dual ownership natively — routing access requests and certifications to the OT-side approver while still giving IT security the enterprise-wide visibility and reporting it's accountable for.

With limited dedicated OT security staff, the inventory has to be built from automated discovery against existing systems — AD groups tied to OT, PAM checkout logs, engineering workstation access lists — rather than manual per-plant surveys, since manual reconciliation across multiple sites is exactly what thin staffing can't sustain. Centralizing this into one governance view across all plants, even where the underlying OT systems remain separate per site, is what turns a periodic audit scramble into something that's simply always current.