Open source PAM for manufacturing and OT: why plant access is different
Vendors and integrators need to reach PLC workstations, historians and HMIs, and the access path should be a browser-based gateway in a DMZ with approval before each vendor session and a recording of everything done during it. That is the short answer for most plants. Apache Guacamole or JumpServer can serve as that gateway, with the web tier and authentication in the DMZ and the protocol connectors reaching into the production zone only over the paths the network design allows. The harder work is deciding who may connect, to what, at which hours, and with what evidence left behind.
IT privileged access patterns break on OT for four reasons. Availability comes first: a session that stalls a historian collector or an HMI runtime can stop a line, so the gateway must not hold sessions open on systems that cannot tolerate an extra login or a monitoring agent. Safety comes second, since a PLC change made remotely can alter machine behavior, which is why change windows and two-person approval matter more here than in an office. Legacy protocols and operating systems come third: many controllers and older Windows hosts cannot take a modern agent, and some only speak protocols the gateway may not natively proxy. Finally, change windows and maintenance contracts are set by the plant, not by the security team, so the access model must match shift patterns and vendor service agreements.
Before choosing a platform, the reader should confirm three things with the plant and the integrator: which target systems can accept a session at all (for example, whether an engineering workstation running RDP is in scope, and whether a PLC vendor tool needs a native client that a browser cannot provide), which network zone each target sits in under the zone model in the manufacturing pack, and who approves a vendor session when the plant is in production. Those answers decide whether Guacamole's clientless RDP and SSH support is enough or whether JumpServer's protocol coverage and approval workflows are needed, and they set the recording scope. Recording is the evidence layer that makes the design defensible, but it only works if the gateway sits where traffic must pass through it and not beside it.
Which requirements shape a manufacturing PAM build
This table maps the main OT, cybersecurity and product regulations to what each one means for a privileged access gateway in a plant. Read it as a set of obligations that sit with the asset owner or manufacturer, where the PAM gateway provides evidence but does not certify compliance.
| Requirement | What it means for the PAM build | Evidence to prepare |
|---|---|---|
| ISA/IEC 62443 zones and conduits | The gateway sits at a conduit between the enterprise zone and the plant or DMZ zone, so its placement follows the zone model agreed in the risk assessment. | Zone and conduit diagram, firewall rules for the gateway, and the list of assets each zone contains. |
| ANSI/ISA-62443-2-1-2024 (asset owner program) | The asset owner must run a security program covering who may access control systems, how vendor access is handled and how changes are governed. The gateway supports these procedures but does not replace them. | Written access procedures, vendor access policy, named roles and periodic review records. |
| ANSI/ISA-62443-3-2-2020 (risk assessment) | Remote access paths into the zones are typically listed as risks. Each approved path needs a documented rationale and residual risk decision before the gateway goes live. | Risk assessment records that name the gateway, its users and the target systems in each zone. |
| ISA-62443-3-3-2013 (security levels) | Target security levels for each zone set the expected strength of identification, use control and audit for sessions. Confirm the target level per zone with the asset owner before choosing MFA and recording depth. | Target and achieved security level per zone, with the control mapping for session authentication and audit. |
| NIST SP 800-82 Rev. 3 (OT security) | The guide covers PLCs, SCADA and DCS access and treats performance and safety as constraints. Session timeouts, maintenance windows and break-glass paths must be tested so they do not disrupt control. | Test records for failover and timeout behavior, and documented emergency access steps agreed with operations. |
| NIS2 Annex II manufacturing scope | Manufacturers in NACE Rev. 2 divisions 26 to 30, and medical and in vitro diagnostic device makers, fall in scope as critical sectors. Confirm with counsel whether your entity is in scope and its size category. | Scope determination memo, asset inventory and access logs for privileged sessions into OT. |
| NIS2 incident reporting (Article 23(4)) | Significant incidents require an early warning within 24 hours, a notification within 72 hours and a final report within one month. Session logs from the gateway must be retrievable fast enough to support these deadlines. | Runbook with log export steps, named reporting owners and a tested retrieval time for session records. |
| Machinery Regulation 2023/1230, Annex III 1.1.9 | From 14 January 2027, machinery must be protected so that connecting another or remote device does not create a hazardous situation. Vendor remote sessions into machines fall under this requirement, so gateway controls must be designed with the machine's safety function in mind. | Risk assessment for remote connection, interlock and safe-state design, and vendor session approval records. |
| CRA Article 14 (manufacturer reporting) | Manufacturers' obligations to report actively exploited vulnerabilities and severe incidents have applied since 11 September 2026, while the wider regulation applies from 11 December 2027. The gateway's own vulnerabilities also count, so track and patch it as a product component. | Vulnerability handling process, patch records for the gateway and the reporting contact list. |
| Responsibility boundary | Obligations rest on the asset owner or manufacturer. The PAM gateway generates access records and enforces controls that help show compliance, and no open-source tool issues a certificate or attestation on its own. | Ask any implementation partner to confirm in writing which artifacts they deliver and which remain your responsibility. |
Which open-source gateway fits which plant
Four gateway choices sit behind most OT access designs: a clientless browser gateway, a full bastion, the edition boundary that decides which features are available, and the network zone where the gateway lands. Each card covers one decision, and the protocol and feature checks must be run against the exact HMI, historian and PLC engineering software in your plant before a choice is made.
Clientless browser gateway with Guacamole
Apache Guacamole is a clientless gateway that serves VNC, RDP and SSH through any HTML5 browser, so engineers and vendors need no agent or client on their workstation. Its web application handles authentication and forwards traffic to the guacd daemon, which loads the protocol plugin for each session. For OT, this means the gateway in the DMZ is the only component that talks to HMIs and engineering stations. Check that your engineering software works over RDP or VNC in the gateway, because the Guacamole protocol only supports what a plugin translates.
Full bastion with JumpServer
JumpServer is a PAM platform and bastion that covers SSH, RDP, Kubernetes, databases and web access from one workspace, which suits plants that also run Linux historians or database servers. Its Community edition is free for self-hosted use up to 5,000 assets in a standalone topology. Plants that need multiple gateways for redundancy should check the high availability tiers, which the pricing page lists as active-standby in Standard and Pro and a full cluster in Ultimate.
Approval and HA features in Enterprise
JumpServer's ticket and just-in-time approval workflows, password rotation, custom roles, SSO and LDAP HA are listed as Enterprise features, while the Community edition is supported through GitHub and the forum. For a vendor session that must be approved before it opens, this is the decision that changes the design. Ask the vendor which approval and HA features are in each tier, and get the tier quoted against your asset count and redundancy target in writing.
Protocol coverage for each HMI
Both gateways depend on the protocol path to each target, and an HMI or historian may use a vendor-specific client, a serial bridge or a database connection that a generic gateway does not carry. JumpServer lists Enterprise proxies for RDP, VNC and database protocols, and Guacamole reaches only what its plugins translate. Build a test matrix for each engineering station, HMI and historian that covers login, file transfer, clipboard, multi-monitor use and session recording before the gateway is approved.
Zone placement in the DMZ
A browser gateway usually sits in a DMZ between the corporate network and the control zones, so placement decides which traffic must cross and which firewall rules apply. The gateway needs inbound sessions from approved vendors and outbound connections to specific OT targets, and nothing else. Confirm the zone model with the plant's OT architecture, and document the conduits that carry gateway traffic, since ISA/IEC 62443 treats those conduits as a security boundary to design and evidence.
Session recording and the player
Guacamole ships a session recording player extension, and JumpServer records sessions through its own components, with the transcoding worker listed as Enterprise. Recordings are the evidence an auditor or plant safety reviewer samples when a vendor changed a controller setting. Confirm where recordings are stored, how long they are kept, who can replay them and whether they can be exported without the gateway, since some OT investigations run outside the IT team.
How a DMZ gateway brokers a vendor session to a PLC workstation
The gateway authenticates the vendor, not the workstation. A vendor engineer signs in to a browser-based gateway such as Apache Guacamole or JumpServer in the DMZ with a named identity from the vendor's own directory or a federated account, and completes multi-factor authentication before anything else happens. The request then waits in an approval queue. Only after a plant-side owner approves a time-boxed window, naming the target PLC workstation or HMI and the job reference, does the gateway open the session. Guacamole can take this identity from Active Directory, LDAP, OpenID Connect or SAML, and JumpServer offers ticket and approval workflows in its Enterprise edition, so confirm which of these your plant's identity source and edition support before you design the approval step around them.
Credential injection is what keeps the workstation password away from the vendor. The gateway holds the account for the engineering workstation in its own credential store and logs in to the target on the vendor's behalf, so the vendor sees the remote desktop or terminal but never the secret. The gateway connects to a jump host inside the OT zone, which then reaches the workstation over the protocol the zone allows. Confirm with your control engineers that the workstation's own account policy, lockout behavior and password rotation still work when the gateway holds the credential. The session recording is written to storage inside the plant or DMZ rather than to a cloud bucket, and the review path for those recordings should be agreed before go-live.
The gateway must not be the only control on a safety-relevant system. A session that is authenticated, approved and recorded can still change a controller program, so the workstation and PLC need their own controls: application allowlisting, restricted removable media, change approval on the engineering project, and a rule that safety functions are changed only under the site's management of change process. The Machinery Regulation adds an essential requirement that machinery be protected so that connecting another device or remote device does not lead to a hazardous situation, applying from 14 January 2027, so the design review should be recorded with the machine's risk assessment. ISA/IEC 62443-3-3 security levels and the zone and conduit model in ANSI/ISA-62443-3-2 are the reference points for deciding which controls sit on each side of the gateway.
How a plant rollout runs in phases
The sequence moves from mapping the plant's zones and conduits to a controlled production cutover, so each phase produces a written artifact the OT team can review before the next one starts. Durations depend on the site, the number of systems and the change windows available, and must be agreed in writing in the scope.
Inventory zones and conduits with the OT team
Engineers, the OT or controls team and the security lead list every PLC workstation, historian, HMI, engineering workstation and vendor access path, then group them into zones and map each conduit between them. Plant network diagrams are checked against what is actually cabled and routed, since older sites often carry undocumented links. The output is a signed zone and conduit register that names the systems each gateway will reach and the networks it must not touch.
Assess risk for each zone and conduit
The team runs a risk assessment in the style of ISA-62443-3-2, which covers security risk assessment for system design, and records the target security level for each zone. Consequences are rated with the plant's safety and production staff, not only IT, because a bad session on a control network can stop a line. The output is a risk register that sets which zones may host a gateway, which need recording and approval, and which vendors need supervised access only.
Design the gateway and DMZ placement
Based on the register, the architect chooses where the Guacamole or JumpServer gateway sits, typically in a DMZ between the business network and the control network, and defines the only permitted flows across each firewall. Connections from the gateway to PLC workstations, historians and HMIs are restricted to named protocols and hosts. The output is a reviewed architecture diagram, a firewall rule set and an access matrix that the OT team approves before any hardware is installed.
Integrate identity and MFA at the gateway
The gateway is connected to the workforce identity provider through LDAP, Active Directory, SAML or OpenID Connect, and MFA is enforced for every engineer and vendor login. Shared accounts on machines are replaced with named identities where the equipment allows, and local break-glass accounts are documented and stored under dual control. The output is a test report showing that each role can log in only with its assigned identity and MFA method, and that the failure paths deny access.
Pilot with one vendor and one line
The first rollout covers one machine vendor and one production line, with the vendor's support engineer working through the gateway under an approved request. The OT team watches the session for effects on the controller and confirms that the vendor can complete the agreed task without a direct network path. The output is a pilot report listing the systems reached, the problems found and the changes made to firewall rules, roles or connector settings.
Validate approvals and session recording
Testers confirm that each vendor session needs an approval from the named owner, that the approval expires, and that the session is recorded from start to end, including the connector and the target host. Recordings are checked for completeness, storage location, retention and whether a reviewer can find a specific session by user, asset and time. The output is a validation record that the plant's quality or compliance owner signs, showing which controls passed and which exceptions remain open.
Cut over to production in agreed change windows
Production cutover happens in change windows agreed with plant operations, with a documented rollback path that returns vendors to their previous method if the gateway fails. Remaining lines are moved in groups, and direct vendor access paths are disabled only after the replacement has been confirmed working for that line. The output is a cutover record for each group, the updated access matrix, and a handover to the operations team covering monitoring, patching and the upgrade schedule for the gateway.
Evidence an auditor or regulator asks for from plant access
This table maps each piece of evidence an auditor, notified body or regulator is likely to request for remote and vendor access to PLC workstations, historians and HMIs to the component that produces it. Read it as a checklist for design: if a row has no named producer in your architecture, plan that source before the first assessment. DeployOpen prepares these systems and records for assessment, but independent auditors and certification bodies issue any opinion or certification.
| Evidence item | What it shows | Producing component | What to confirm before go-live |
|---|---|---|---|
| Vendor and engineer access list | Who holds standing or approved access to each OT asset, by zone | Gateway (Guacamole or JumpServer) asset and permission configuration, exported on a fixed schedule | Asset inventory matches zone design; no shared accounts remain on target hosts |
| Unique user identification | Each session tied to one named person or vendor identity, not a shared operator login | Identity provider (for example Keycloak or your directory) feeding the gateway | Vendor users are individual accounts; shared PLC or HMI logins are retired or vaulted |
| Approval records | Who approved each vendor session, when, for which asset and time window | Gateway ticket or approval workflow; confirm which features sit in the edition you select | Approval is captured before the session opens, not recorded afterward |
| MFA logs | Strong authentication was applied at the gateway for remote and vendor sessions | Identity provider authentication log and gateway login records | MFA applies to every remote path into the DMZ, including vendor accounts |
| Session recordings and retention | What was done on the engineering workstation or HMI, and how long the record is kept | Recording store on local storage inside the zone, with retention set by policy | Recording location, encryption, access rights to recordings and retention period agreed with compliance |
| Change records tied to sessions | Links between a maintenance window, a change ticket and the session that carried it out | Change management system referenced in the approval, plus session metadata | Ticket identifiers are mandatory fields at session start |
| Security monitoring and SIEM forwarding | Gateway and session events reached a monitored store with time synchronization | Wazuh or Security Onion collecting gateway logs and DMZ sensor data | Log forwarding is tested end to end and time sources are consistent across zones |
| Network zone and conduit documentation | Proof that the gateway sits in the DMZ and that no direct path reaches the control zone | Architecture diagrams and firewall rules maintained with the zone model | Diagrams match live firewall rules; each conduit has a named owner |
What do buyers ask before a manufacturing PAM project?
What actually drives the cost of a manufacturing PAM project?
Cost is driven by the number of zones and sites, the gateway hosting you choose, recording storage, the edition you need, and the time spent testing in OT. Open-source gateways such as Apache Guacamole carry no license fee under the Apache License, Version 2.0, and JumpServer's Community edition is free for up to 5,000 assets in a standalone topology. Recurring costs include hosting, storage for session recordings, patching and staff time. One-time costs include design, zone and firewall work, testing and cutover. Ask any partner for a quote that separates these items, states which edition each feature needs, and lists the change windows assumed for each site. DeployOpen quotes follow from a written scope, not a price list.
How long does a manufacturing PAM rollout take across several plants?
Duration depends mostly on the number of sites, how many zones each site has, and how often production windows allow changes. A single pilot cell can be scoped separately from a multi-plant rollout, which should be phased site by site with a repeatable build. Each site needs its own zone review, firewall rules, vendor onboarding and testing before cutover. DeployOpen does not publish timelines; the duration is set in the written scope after the plant team has provided its zone diagrams and maintenance calendar. Ask for a phased plan with a go or no-go gate per site.
What does the plant team need to provide before a PAM design starts?
The design starts from the plant's own records, so the team should prepare:
- Network zone diagrams showing the levels where PLC workstations, historians, HMIs and the DMZ sit
- An asset list with make, model, firmware version and the protocols each device uses
- A list of vendors and integrators who need remote access, with the systems each one touches
- Maintenance windows and production freeze periods for each site
- Existing accounts, shared logins and firewall rules that the new gateway will replace
The ISA/IEC 62443 series expects an asset owner to know these items before selecting controls, so gaps here usually become delays later.
Can our in-house team run a manufacturing PAM gateway after launch?
Many plants can run a gateway once it is built, but the work after launch is ongoing. Someone must own user and vendor accounts, approval rules, recording retention, patching of the gateway, backups and access reviews. JumpServer's quickstart asks for a clean 64-bit Linux server with at least 4 CPU cores and 8 GB of RAM, which is a small footprint, but operating it in OT still needs change control and tested rollback. Teams with limited staff often use a retainer for upgrades and monitoring. Decide the owner for each task before the build, and confirm which features your edition includes.
Does a PAM gateway by itself satisfy ISA/IEC 62443?
No. A PAM gateway supports several requirements, including controlled remote access, unique user identification and session logging, but ISA/IEC 62443 covers the whole program. ANSI/ISA-62443-2-1-2024 sets security program requirements for asset owners, ANSI/ISA-62443-3-2-2020 covers risk assessment for system design, and ISA-62443-3-3-2013 defines system security requirements and security levels. Component and product requirements in ANSI/ISA-62443-4-1-2018 and ANSI/ISA-62443-4-2-2018 sit with suppliers. Use the gateway as one control within a documented zone and conduit design, and confirm the target security level with your assessor.
How does the Machinery Regulation affect a remote access design?
Regulation (EU) 2023/1230 applies from 14 January 2027 and includes an essential requirement in Annex III, 1.1.9, that machinery be protected so that connecting another device or a remote device does not lead to a hazardous situation. For remote vendor sessions, that means the design must prevent a remote connection from changing machine behavior unsafely. In practice, plants should restrict vendor sessions to read-only or approved actions where safety depends on it, require approval before each session, and record activity. Involve the machine safety lead and the machine manufacturer early, and confirm the conformity route for each machine with the regulation text and a qualified adviser.
Will vendor sessions into PLC workstations stop production?
A well-designed gateway should not interrupt running production, but change is the main risk. Installing the gateway, changing firewall rules, or altering authentication can affect HMIs and historians if done during a run. Test in a non-production environment that mirrors the target site, and schedule the first live vendor session within an agreed maintenance window with a rollback plan. Confirm which protocols each vendor needs, such as RDP or SSH, because the gateway must reach those systems without opening new paths into the control network.
What to ask an implementation partner for plant access
Start with zones and conduits. Ask the partner to show how they have placed a gateway between the business network and an OT zone in past work, which zone model they used (ISA/IEC 62443 terminology is a fair baseline), and how each conduit is documented. Ask who on their team has worked on PLC workstations, historians and HMIs, and whether they can describe a case where a vendor session had to be stopped or restricted by the plant rather than by the access platform. Ask how the design avoids touching PLC logic and safety functions: the gateway should sit beside the control network, not inside the control loop, and changes to controllers, safety instrumented systems or their programming software should be out of scope in writing. Next, test the change process. Ask how change windows are negotiated with production, what happens when a window is missed, and whether the partner will validate every protocol path (for example Guacamole's RDP and VNC connections or JumpServer's SSH and RDP proxies) in a lab that mirrors the plant's operating systems and legacy software before the first cutover. Ask who records the lab results and who signs them off. Confirm whether the partner has delivered offline or air-gapped installations, because some plants cannot reach an installer or update channel. Ask how the platform is installed and upgraded from media, and what the partner needs from the plant to do so. Finally, settle the operational terms. Ask where session recordings are stored, how long they are kept, and whether storage and search stay inside the plant. Ask which approval, high availability and multi-site features depend on the paid JumpServer editions, and whether the quote includes them. For handover, ask who holds the root, database and recording-encryption keys at the end of the engagement, and whether the plant can rotate them without the partner. The answers should be written into the statement of work before work starts.
Integration points and deployment pattern for plants
A plant PAM deployment is a chain of components that each sit in a specific network zone and connect to a specific neighbor. The cards below cover the identity provider, the DMZ gateway, the OT-zone jump host, the recording store, the SIEM feed, and the backup and patching path, along with the checks to run on each link before any vendor session is allowed.
Identity provider with MFA
The gateway should authenticate engineers and vendor accounts against a central identity provider, not local accounts on the gateway. Keycloak, authentik, ZITADEL or FreeIPA can provide this, and the MFA method should be enforced at the identity layer so every session passes through it. Check whether the identity provider lives in the IT zone, whether it stays reachable when the plant WAN is down, and whether a local break-glass path exists if it is unavailable. Confirm that MFA is enforced for vendor accounts as well as staff.
Gateway in the DMZ
A browser-based gateway such as Apache Guacamole or JumpServer sits in a DMZ between the corporate IT zone and the plant OT zone. Users reach it over HTTPS from the IT side, and only the gateway opens protocol sessions into OT. Guacamole's web application speaks only the Guacamole protocol and forwards it to guacd, which loads the protocol plugin for RDP, VNC or SSH. Verify which ports open between zones and that no OT system initiates a connection outward to the gateway.
Jump host in the OT zone
Some PLC workstations, HMIs and historians accept only connections from a local host or a specific subnet, so a jump host inside the OT zone can be needed as the last hop. The gateway connects to this host, and the host then opens the engineering session on the controller. Each extra hop adds a place where credentials, recordings and time synchronization must be consistent. Confirm with the automation vendor which protocols and tools the engineering software needs and whether it runs on a Windows or Linux host.
Recording store inside the plant
Session recordings contain the commands and screens of engineers working on controllers, so they should be stored in a location the vendor cannot alter or delete. Keep the store in the DMZ or a protected IT segment, separate from the OT network, with access restricted to the audit group. Ask how the platform handles recording retention and whether recordings are encrypted at rest. Guacamole includes a session recording player extension, but confirm the storage and retention behavior of your chosen version with the project documentation.
SIEM and syslog feed
Login attempts, approvals, command events and session start and stop times should reach the plant or corporate SIEM through syslog or an agent. This lets the security team detect a vendor session that runs outside its approved window, even if the plant has no local monitoring. Where the OT side is monitored by Security Onion, Suricata or Zeek sensors, correlate gateway events with network flows at the DMZ boundary. Confirm which log fields the gateway exports and how long logs stay in the plant if the WAN link fails.
Backup and patching path
The gateway, its database and the recording store all need backups and a patch route that works without direct internet access. Plant maintenance windows are often short and tied to production schedules, so the patch process should be rehearsed on a staging copy before it is applied. Media transfer may be the only route into the zone. Ask the vendor for its release cadence and the upgrade path between major versions, and confirm that restores of both configuration and recordings have been tested.
What changes for the plant team after go-live
The biggest change for plant staff is that every vendor session becomes an approved, recorded event. Before go-live, a machine builder's support engineer may have dialed in over a shared modem or a standing VPN account. Afterward, the vendor requests access in the gateway (JumpServer or Guacamole in the DMZ), a plant owner approves a time window, and the session is opened with credentials injected by the gateway so the vendor never sees a PLC or HMI password. Plant owners should agree in advance who approves, what the fallback is when the approver is on a night shift, and how long a window may run. These rules belong in the access procedure before the first vendor visit, not after.
Shift handover changes less than people fear, but the handover checklist has to name the gateway. Engineers who hold named accounts should not share a login at the console or on the historian workstation, and a shift lead should be able to see who is currently connected to a HMI or engineering station. Confirm with your own environment whether session monitoring on the gateway shows live sessions to operators, and whether the recording player can be opened by a shift lead or only by the security team. Agree a short procedure for handing over an open session that spans shifts, since a vendor window that crosses midnight is a common source of confusion.
Emergency access needs a written break-glass procedure that the plant can execute without the gateway's normal approval path, because a PLC fault at 3 a.m. cannot wait for a ticket. Define a small set of sealed, locally stored emergency credentials for the most critical stations, record who can unseal them, and require that every use is logged and reviewed the next working day. Patching the gateway is the other change: plan it into planned outages with the production schedule, test the update on a non-production copy, and confirm a rollback path. Ask your implementation partner how the update is delivered to an isolated DMZ host and which checks confirm the recordings still play back afterward.
Common questions about open source PAM in OT
Can a browser-based gateway like Guacamole safely sit in the manufacturing DMZ?
Yes, a browser-based gateway such as Apache Guacamole or JumpServer is commonly placed in a DMZ between the corporate network and the OT zones, provided the placement follows your zone and conduit design. The gateway terminates the vendor or engineer session, so the workstation behind it never needs to be reachable from the outside. Guacamole's web application handles authentication and the web interface, while the guacd daemon connects to the target over RDP, VNC or SSH. Confirm with your OT security lead which zones the gateway may reach, which ports are open, and whether the DMZ meets the zone model in your manufacturing network pack. Review the design against ISA/IEC 62443 before any firewall change.
Why do vendor sessions to PLC workstations need approval before they start?
Approval before a vendor session keeps a machine builder from reaching a live production system without a named business owner agreeing to the work, the window and the systems involved. A ticket or approval workflow ties each session to a change record, which is what plant managers and auditors ask to see. JumpServer's Enterprise edition lists ticket and just-in-time approval workflows among its paid features, so confirm whether your required approval flow sits in the free edition or a paid tier. Ask the vendor how approvals interact with the maintenance windows you already run, and whether an approver can end a session that is running late.
Does session recording help meet NIS2 or IEC 62443 requirements?
Session recording supports monitoring and investigation duties under several frameworks, but it does not satisfy a requirement on its own. NIS2 requires in-scope entities to report significant incidents within 24 hours for an early warning, 72 hours for notification and one month for a final report, and recordings help reconstruct what a vendor did during an incident. IEC 62443 covers the broader security program, so recordings should sit inside documented policies, zone design and access reviews. Ask your compliance lead which control evidence the recordings must support, how long they must be kept, and where they will be stored.
Can engineers reach historians and HMIs through a bastion without changing the PLC logic?
Usually yes, because a bastion operates at the access layer and does not alter the control logic running on the PLC. The gateway proxies RDP, VNC or SSH sessions to engineering workstations, HMIs and historians that already exist. Changes to the machines themselves are limited to account setup, network routing and any service accounts used for password injection. Test every target in a non-production replica first, especially legacy Windows systems that require older protocol versions. Confirm with the controller and HMI vendors that remote session tools are supported under their warranty and support terms.
Which parts of a manufacturing PAM project does an implementation partner handle?
A partner such as DeployOpen typically plans the zone placement, installs and hardens the gateway, configures identity integration, approval and recording, and documents the evidence the plant needs. Most engagements are fixed-scope, so the list of target systems, zones, protocols and deliverables is agreed in writing before work starts. The plant still owns the change approvals, the OT safety review, the vendor contracts and the decision on which systems may be reached remotely. Ask any partner to state in the quote which systems are included, which are excluded, and who signs off changes in the production network.
What does an open source OT PAM project cost to run each year?
Costs fall into one-time work and recurring work. The one-time items are the zone design, gateway build, identity integration, testing against each OT target and documentation. The recurring items are patching the gateway, reviewing access lists, storing and searching recordings, and handling vendor changes. Software licensing depends on the platform and edition you choose. JumpServer's Community edition is free for up to 5,000 assets in a standalone topology, while its Enterprise tiers are priced by quote and add high availability and features such as password rotation. Ask any quote to separate the software, hardware, partner work and ongoing support.
What hardware does a bastion for the OT zone need?
The gateway itself has modest requirements, but the surrounding infrastructure drives the real cost. JumpServer's quickstart asks for a clean 64-bit Linux server with at least 4 CPU cores and 8 GB of RAM, which is a starting point rather than a sizing guide for a plant. Storage for session recordings grows with the number of sessions and the retention period you set, so estimate that from your vendor session volume. High availability, a second gateway in the DMZ and a secure jump host for administrators add hardware and licensing. Confirm the sizing with the platform vendor and your own load tests.
How should break-glass access work when the bastion is down during a production fault?
A break-glass procedure gives a small set of named people a documented way to reach a machine when the normal gateway is unavailable. The procedure should define who holds the emergency credentials, where they are stored, who approves their use, and how each use is logged and reviewed afterward. Keep the emergency path tested, because a break-glass route that nobody has used for a year may fail when needed. Ask your plant and IT teams to agree the procedure before go-live, and confirm with the platform whether emergency access is recorded when the gateway is bypassed.
How DeployOpen scopes, builds and supports plant access
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including OT-adjacent access layers in the DMZ. For manufacturing and OT privileged access, the work starts with a written scope that fixes the zones, protocols, vendors and recording rules before any gateway is installed.
How we scope
- Map which PLC workstations, historians, HMIs and vendor paths the gateway must reach, by network zone.
- Agree in writing which protocols, approval steps and session recording rules apply to engineers and machine vendors.
- Confirm the edition, asset count and high availability needs with the platform vendor before quoting.
How we build
- Deploy the browser-based gateway in the agreed DMZ position with identity provider and MFA integration.
- Configure vendor approval workflows, time-limited access and session recording stored inside the client's environment.
- Test access paths against the zone rules and document the firewall and conduit assumptions for review.
How we hand over
- Deliver architecture, configuration and runbook documentation covering each zone and access path.
- Walk operations and plant IT teams through approvals, recording review and break-glass procedures.
- Prepare the access lists, session logs and change records that auditors or asset owners typically request.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover.
- Plan platform upgrades and patching with plant change windows agreed in advance.
- Retest access controls after zone changes, new vendors or platform releases.
