Remote maintenance: how far does a contractor’s access reach?

The war on ordinary machines · Part 3 of 7

A remote repair can open a route to several devices. Vendor documentation and security guidance show how a service assignment becomes a set of permissions and dependencies, and what an operator needs to retain control.

In a support note dated 20 March 2026, HMS Networks describes the network reach of its remote-maintenance solution. A user connecting to a FlexEdge gateway through Talk2m can, by default, reach the selected subnet, a segment of the network, and the devices accessible behind that interface. Narrower access requires explicit filtering rules. The vendor is describing how its product works, along with the controls available to constrain it. Reaching a device across a network remains distinct from having permission to inspect or change its operation. 1

A company may therefore commission support for one machine while technically granting a route to neighbouring equipment. The assignment and the available network access can have different boundaries. This observation does not connect FlexEdge or Talk2m to the attacks on commercial refrigeration. It provides a documented starting point for a broader question: how much authority travels with a maintenance contract?

France’s refrigeration alert, published on 12 October and updated on 16 October 2026, makes that question tangible. CERT-FR, the French government’s incident-response centre, calls for the removal of direct internet exposure and the restoration of protected access. It also tells operators to check insurance terms before interrupting data reporting to their refrigeration contractor. A connection carries a technical service, commitments and dependencies that need to be understood. 2

Following the instalments on refrigeration incidents and control authority inside machines, this article follows the companies and permissions that cross a site’s boundary. It is a documentary investigation based on public architectures, product documentation and official guidance. Individual contracts and victims’ configurations remain outside the evidence available to us.

Buying time to restore a service

The US National Institute of Standards and Technology (NIST) published its final cybersecurity architecture guide for the water and wastewater sector on 24 June 2026. Its discussion of remote access starts with operational needs: geographically dispersed sites, out-of-hours support, diagnostics and vendor assistance for equipment that can be difficult to reach. It also examines cloud services that take on part of the access infrastructure. The guide is sector-specific; the functions it describes are useful for this investigation. 3

The economic case is easiest to understand through an ordinary maintenance scenario. A specialist who can inspect operating conditions before travelling may arrive with a likely diagnosis, relevant information and, potentially, the right replacement part. A fault that can be resolved remotely removes the journey altogether. Where physical work remains necessary, remote diagnosis can prepare it. The outcome depends on the equipment, the fault and the people available.

A meaningful performance measure would be the time from notification to restoration of a usable function, compared with an equivalent intervention without remote access. Establishing a saving would require comparable service records, separating the wait for a technician, travel, diagnosis and repair. The documents reviewed here do not provide that comparison. We can explain the mechanism without attaching an unsupported savings percentage to it.

Outsourcing may also bring expertise that an operator would struggle to maintain in-house. France’s national cybersecurity agency, ANSSI, explicitly acknowledges this in its December 2010 outsourcing guide: using a provider can be desirable where internal skills are missing. That is a substantive counterargument to treating every third-party connection as a design failure. 4

The trade-off is to acquire repair capacity while retaining enough control over how it is used. A small team benefits from having a specialist available. It also benefits from knowing which equipment that specialist can reach, who authorises the work and how control is recovered when the relationship changes.

Method and scope

Conceptual diagram informed by HMS’s FlexEdge/Talk2m documentation of 20 March 2026. The three icons represent categories, not observed device counts. The second configuration illustrates deliberately restricted scope. Network reachability remains distinct from application permissions. No victim architecture or vulnerability exploitation is depicted.

The site can initiate the connection

The most intuitive picture of remote access puts an open internet-facing door in front of a machine. Other architectures arrange the meeting elsewhere. A support note updated by HMS on 2 January 2023 describes outbound connections for Ewon Flexy and Talk2m: the gateway connects to the remote service through a VPN tunnel, a protected communication channel. 5

The direction of establishment deserves attention. “Outbound” identifies which side starts the connection. Once a session is authorised, information may travel in both directions, subject to the service and its controls. An engineer can therefore communicate with equipment behind the gateway even though no direct inbound access to that equipment has been published on the internet. Control moves to the intermediary, its accounts and the rules governing the route.

International guidance on operational technology, or OT, published in January 2026, including by the UK’s National Cyber Security Centre (NCSC), recommends brokered connections through a gateway in a separate security-controlled zone. It couples that approach with protection of the intermediary and limits on when access is available. Reducing direct exposure therefore brings identity management, updates and permissions into sharper focus. 6

The access infrastructure can also be operated locally. NIST depicts a remote-access server in an intermediate zone, commonly called a DMZ, where the external connection terminates; a separate connection then reaches into the industrial network. The zone provides a place to apply controls before production resources become accessible. The architecture describes functions whose implementation depends on the installation. 3

An operator’s investigation needs to follow the actual route. Who administers the gateway? Who can enrol another engineer? Which network becomes reachable? A subscription invoice or product name answers only part of the question. The complete answer combines the contract, the configuration and the permissions actually assigned.

Method and scope

Functional view of brokered access. HMS documents outbound establishment; NIST and NCSC describe intermediary controls. Routes are neither a product configuration nor a claim that VPN implementations are equivalent. Establishment and use are separate functions; arrows do not encode duration or throughput.

Several companies, different kinds of authority

Consider a hypothetical arrangement. The manufacturer understands the machine. An integrator assembled it with other equipment. A maintenance company provides on-call support. A platform handles connections, while the operator understands production conditions and the constraints on site. These functions may sit within one organisation or be shared among several.

Authority can become fragmented in that arrangement: one person knows how to repair the equipment, another can create an account, and a third holds the documents needed for recovery. A useful review brings those capabilities back to the decision to authorise work. It starts with the customer receiving the service and follows every organisation that may act on the customer’s behalf.

ANSSI’s March 2016 guidance for industrial integration and maintenance providers calls for identified personnel, specified roles and an intervention protocol agreed with the customer. For remote maintenance, it also envisages a dedicated workstation at the customer’s request. The framework offers a basis for contractual discussions; the customer can incorporate its requirements into a specification. 7

The relationship takes on another dimension when a provider serves several customers. In their joint advisory of 11 May 2022, US and partner security agencies explain why managed IT service providers attract attackers: the provider’s trusted relationships can become routes into customer environments. The analysis concerns IT service providers. It illuminates a dependency mechanism rather than establishing how often industrial maintenance companies are compromised. 8

From that mechanism, a shared-risk scenario can be constructed. Several sites may depend on one administrative account or one access service. A failure in that dependency could affect them at the same time. The reach of the event depends on separation, permissions and recovery options. A provider’s customer count, on its own, cannot establish either incident probability or financial losses.

The NCSC recommends centralising and standardising access paths instead of accumulating a separate entry point for every vendor, so that controls and monitoring can be applied consistently. 9 In our analysis, that simplification brings an additional requirement: document the availability of the common access path and how it can be replaced. Centralisation supports governance; continuity requires its own examination.

Method and scope

Hypothetical organisation for examining the contractual chain. A manufacturer may also maintain or integrate equipment; the platform may be managed by the customer or a supplier. Roles are separated to reveal decisions and evidence that need to be reconciled. This is not a verified contract or incident.

Customer approval needs technical effect

A contract describes permission to perform work. Its technical implementation should identify a person, a task, a scope and an authorised period. ANSSI’s November 2025 industrial-security guide recommends on-demand connections for a defined duration, with logging and separation of the equipment being accessed. The duration mentioned in the guide is an example, to be adapted to operational constraints. 10

That raises a practical question: who approves access when an alarm occurs outside normal working hours? A process that depends on an unreachable person may delay the repair. A workable arrangement needs delegated authority, on-call cover and an emergency process, while preserving a record of the decision. This is an organisational proposal to be tested against the service’s actual conditions.

Commercial products show how that allocation of authority can be implemented. IXON advertises temporary access and customer approval features, along with an option that gives the customer control over certain permissions. These are vendor-described capabilities. Their activation, scope and commercial conditions need checking for the particular installation. 11

Another example puts a decision back on site. HMS describes connection control through a digital input on Ewon Cosy. Its June 2024 support note explains that the corresponding Flexy implementation uses a script, and distinguishes disabling the VPN from disabling the external connection. 12

The implication is straightforward. A physical switch may instruct software to change a connection state. Its presence should prompt questions about the exact function it controls, the routes it covers and what happens when something fails. Those properties must be established before assigning it independent safety significance or relying on it as the sole means of recovering control. Nothing in this article provides a disconnection procedure for live equipment.

The contractor’s last connection

Completing a maintenance job and ending an access right are separate events that need to be reconciled. One belongs to the work record. The other may concern an account, an already-open session, a certificate or a software integration. Closing the job records that the service has been completed. Demonstrating technical closure requires evidence appropriate to each access mechanism.

IXON’s API documentation provides a specific example. It distinguishes user tokens from service-account tokens, which it describes as having no automatic expiry. The latter carry an integration’s identity and permissions. They grant access to an API, an interface used by software; their scope depends on the functions and permissions available. 13 The dedicated service-account page adds that the account remains active if its creator leaves the company or is deleted. It also sets a material limit: connection requests protected by Access Requests are automatically declined for service accounts; those accounts are also unable to approve such requests. These properties describe a separate lifecycle with its own permission boundaries. 18

Ewon’s Ecatcher help describes disabling a user as preventing that user from logging into the account. That is a useful stated property. The treatment of an existing session needs separate verification against the behaviour and version actually deployed. 14

Now consider a change of maintenance provider. The operator needs to distinguish human accounts used for interventions from software credentials supporting monitoring or another service. Some will be removed; others may need transfer or replacement to preserve a required function. Decisions should follow the credential’s actual purpose, its owner and a documented revocation process.

The same reasoning applies when an engineer leaves a contractor. A named account ties permissions to a declared identity; a shared secret used by several people requires examining all of its users. Traceability therefore depends on the provider’s organisation as well as the technology. The operator can ask for documentary evidence of how departures and changes of assignment are managed, keeping credentials and secrets outside that exchange.

Method and scope

Logical sequence without a time scale. Session termination is a state to confirm. IXON service-account API tokens are documented without automatic expiry and may outlive deletion of their creator. Their scope follows API permissions; connections protected by Access Requests from a service account are automatically rejected. These tokens are not equated with universal VPN access or industrial-control authority. Retained access needs a purpose and an owner.

The operator needs access to the evidence

An intervention may leave records in several places: a support system, an access platform, a gateway, engineering software and the modified device. Reconstructing a decision requires connecting those records. A successful authentication identifies an access event; a work report explains an intention; configuration history helps establish a change. This is an investigative method to adapt to the records actually available.

The NCSC stresses monitoring connections and coordinating maintenance periods with security monitoring. Planned work may change the behaviour that is expected. Detection rules need to return to their normal operation when the maintenance window ends. 15

In its March 2024 guidance, France’s data-protection authority, CNIL, recommends recording maintenance work, addressing access in the contract and providing for its closure. Its remit here is personal-data security. We draw on the documentary approach for discussions with a provider, without presenting the guidance as a universal industrial-sector rule. 16

The practical question is whether the operator holds enough evidence to understand an intervention, including after a disagreement with the supplier. Retention periods, export formats, access to records and responsibility for reviewing them can be agreed in advance. Their value depends on their availability and on the specific actions they can illuminate.

Planning for support when the link is cut

Recovering control over access can change the service being delivered. Sending an alarm to a contractor, obtaining human assistance and allowing writes to equipment are different functions. Their actual separation has to be established through architecture and dependencies. A commercial diagram cannot guarantee that they will survive independently when a connection is interrupted.

The NCSC devotes an entire principle to isolation planning. It calls for consideration of business impacts and third-party arrangements, including the possibility of moving from remote support to attendance on site. It also describes targeted isolation that preserves other services where the architecture supports it. 17

That connects directly with CERT-FR’s warning about data reporting to refrigeration contractors. The advice specifically concerns contractual insurance terms. Applicable cover and operational decisions depend on the contract and the installation. 2

Comparing two maintenance arrangements should therefore examine two situations: ordinary service and a loss of trust in remote access. The second reveals travel requirements, availability of an authorised person, access to documentation and the ability to keep useful monitoring in operation. Such a comparison would put a cost on switching providers while retaining the required functions.

Method and scope

Conditional scenario informed by NCSC isolation strategies. The data branch assumes designed and verified independence, potentially hardware-enforced controls; local control assumes all its dependencies remain available. On-site support depends on contracts and skills. No disconnection step or behaviour of a particular installation is prescribed.

Public sources establish available capabilities, boundaries that need constraining and recommended controls. They leave an important field question unanswered: how many operators can connect a commercial mandate to an exact set of permissions, then demonstrate that those permissions have been withdrawn? Answering would require contracts, configurations and anonymised records obtained with the parties’ agreement.

The next useful piece of evidence would be a complete maintenance file, from authorisation to verified technical closure. It would show whether the company that owns the machine also retains the means to organise repairs, follow their effects and change the people providing them. That is the level at which remote maintenance becomes a service the operator can genuinely control.

Scope of the investigation

This documentary investigation was checked on 3 November 2026. Commercial capabilities are attributed to their vendors and architectures are explanatory models. Victim configurations, individual contracts and maintenance histories remain unknown. Research used public documents; no industrial network or production service was queried.

Continue reading

• Part 1: supermarket freezers become a target, on the incidents and physical mechanism.
• Part 2: who actually controls the machines?, on settings, permissions and local functions.
• Wind and solar: cyber access and responsibility, on dependencies in remote access.

Sources

Documents checked on 3 November 2026. The references identify the versions reviewed and the scope of the examples.

1. [1] · HMS Networks · 20 March 2026 · Checked on 3 November 2026Secure Remote Access to FlexEdge Using Talk2m

   HMS describes routed network access to the subnet of the FlexEdge interface selected for Talk2m. Reachable devices are included by default; narrowing that scope requires explicit filtering rules.

   Passages and scope

   Architecture Overview; Security Consideration: Network Access and Routing Behavior; Important Behavior; Best Practice: Network Segmentation. Limited to FlexEdge with Talk2m as described by the vendor. Network reachability and application authorization are distinct. No victim deployment, actual configuration or laboratory validation is established. Official page accessed directly on 3 November 2026; relevant passages read.

2. [2] · ANSSI / CERT-FR · 12 October 2026; latest revision: 16 October 2026 · Checked on 3 November 2026Security incident targeting remote refrigeration controllers

   Alert on exposed refrigeration controllers; protected access and contractual insurance terms to check before interrupting reporting to the refrigeration contractor.

   Passages and scope

   Document history; affected systems; solutions. An aggregate alert. Victim-specific architectures, contracts and logs remain unknown; no link to the vendors discussed here is established. Official page accessed directly on 3 November 2026; relevant passages read.

3. [3] · NIST / NCCoE · Final, June 2026; published 24 June 2026 · Checked on 3 November 2026SP 1800-45: Cybersecurity for the Water and Wastewater Sector: Build Architecture

   Operational remote-access needs; DMZ termination and a separate connection into OT; cloud alternatives.

   Passages and scope

   Sections 3.1–3.3, printed pages 7–10; sections 4.1–4.2, pages 11–13. Water-sector reference examples. Economic benefits discussed here are scenarios, without measured savings or monetary estimates. Official PDF downloaded and read; printed page 11 rendered and inspected. Publication date corroborated by the NCCoE record.

4. [4] · ANSSI · 3 December 2010 · Checked on 3 November 2026Outsourcing and information-system security: a guide to managing risks

   The value of external expertise where internal capabilities are insufficient; managing outsourcing risks.

   Passages and scope

   Official guide presentation. Historical, general guidance. The linked PDF is not used as evidence here; its scope extends beyond industrial maintenance. Official page accessed directly on 3 November 2026; relevant passages read.

5. [5] · HMS Networks · Updated 2 January 2023 · Checked on 3 November 2026Which port(s) should I open in my firewall to allow connection to Talk2M?

   The HMS note, applicable to Ewon Flexy, describes Talk2m connections initiated outbound, without an inbound connection from the Talk2m server to the gateway.

   Passages and scope

   Updated field, Applicable products and Answer. Connection initiation alone does not define the exchanges authorized after establishment. No port, address, setting or actual-installation behaviour is reproduced. Official page accessed directly on 3 November 2026; relevant passages read.

6. [6] · NCSC and partner agencies · 14 January 2026; version 1.0 · Checked on 3 November 2026Secure connectivity for OT, principle 2: limit the exposure of your connectivity

   On-demand connectivity, outbound initiation and brokering in a controlled zone; protecting and maintaining the intermediary.

   Passages and scope

   Reduce time of exposure; Remove inbound port exposure. Connection initiation does not define application permissions. The earlier “Reviewed 18 March 2024” field is website metadata, not evidence of a later revision. Official page accessed directly on 3 November 2026; relevant passages read.

7. [7] · ANSSI · 10 March 2016; version 1.0 · Checked on 3 November 2026Cybersecurity requirements for industrial-system integration and maintenance providers

   A basis for procurement specifications; a dedicated workstation at the customer’s request, identified personnel and an approved intervention protocol.

   Passages and scope

   Section II.1, page 5; sections IV.3.5 and IV.4.1, page 14. A framework for services and contractual clauses. Its existence establishes neither a universal legal duty nor installation compliance. Official PDF downloaded and read; page 14 rendered and inspected.

8. [8] · NSA and partner agencies · 11 May 2022 · Checked on 3 November 2026NSA, Partners Issue Guidance to Secure Managed Service Providers, Their Customers

   Abuse of trust relationships between managed service providers and customers; contractual allocation of responsibilities.

   Passages and scope

   Joint-advisory announcement; guidance for providers and customers. The subject is managed IT service providers. Its relevance to industrial risk is an explicit analogy, without incident-frequency or loss estimates. Official page accessed directly on 3 November 2026; relevant passages read.

9. [9] · NCSC and partner agencies · 14 January 2026; version 1.0 · Checked on 3 November 2026Secure connectivity for OT, principle 3: centralise and standardise network connections

   Consistent access paths, shared controls, monitoring and contracts that accommodate architecture changes.

   Passages and scope

   Principle 3: centralise and standardise network connections. Dependence on a common access path and its replacement are continuity considerations; availability is not guaranteed by centralisation. Official page accessed directly on 3 November 2026; relevant passages read.

10. [10] · ANSSI · 27 November 2025; version 2.0 · Checked on 3 November 2026Industrial-system cybersecurity: detailed measures

    On-demand, time-bounded, authenticated and logged remote-maintenance connections with segmentation.

    Passages and scope

    Section 4.2.5.1, printed pages 73–74; measure R.129.Cl.1. The suggested duration is an example. The guide distinguishes system classes; no victim classification or configuration is presumed. Official PDF read and relevant pages inspected on 3 November 2026; identical copy verified by hash.

11. [11] · IXON · Undated page, accessed 3 November 2026 · Checked on 3 November 2026Secure remote access to the cloud for industrial machines

    IXON advertises customer approval of access requests, temporary access and the Oversight add-on. The latter separates gateway technical management from customer authority over specified approvals.

    Passages and scope

    Features: Access request and approval, Temporary access, IXON Oversight for your customer. Interested commercial material. Activation, licensing, contractual terms and actual scope remain to be checked; no NIS2 compliance, safety independence or audited effectiveness is inferred. Official page accessed directly on 3 November 2026; relevant passages read.

12. [12] · HMS Networks · Updated 24 June 2024 · Checked on 3 November 2026Enable/Disable Ewon Flexy WAN or VPN connection using a key switch

    The note distinguishes Cosy’s digital-input option from the described Flexy implementation using a BASIC script. It separates VPN control from control of the WAN/internet connection.

    Passages and scope

    Introduction and Applicable products; headings of the two WAN and VPN implementation variants. A distinction between vendor functions, without evidence of an independent safety circuit or guaranteed failure response. The script and its parameters are neither reproduced nor executed. Official page accessed directly on 3 November 2026; relevant passages read.

13. [13] · IXON · Undated page, accessed 3 November 2026 · Checked on 3 November 2026IXON API Authentication

    API tokens identify the actor, permissions and accessible data. The documentation distinguishes expiring user tokens from service-account tokens without automatic expiry, tied to their application identifier.

    Passages and scope

    How to get an access token; Note on Service Account access tokens. Limited to the API and the identity’s permissions. Token permanence grants neither universal machine-control authority nor general VPN access. No API call or example credential is reproduced. Official page accessed directly on 3 November 2026; relevant passages read.

14. [14] · Ewon / HMS Networks · Undated help page, accessed 3 November 2026 · Checked on 3 November 2026Ecatcher Help: Users

    Ecatcher help says a disabled user can no longer log into the account. It mentions a confirmation when the application remains open following a current or earlier connection.

    Passages and scope

    User Properties: Status; Disable. The text reviewed does not specify the precise handling of a pre-existing session. It establishes neither continued session access after disabling nor revocation of every other token, certificate or integration. Official page accessed directly on 3 November 2026; relevant passages read.

15. [15] · NCSC and partner agencies · 14 January 2026; version 1.0 · Checked on 3 November 2026Secure connectivity for OT, principle 7: ensure all connectivity is logged and monitored

    Useful logs, verification of legitimate maintenance and coordination of maintenance windows with security monitoring.

    Passages and scope

    Principle 7; Unauthorised activity; Data flow monitoring. Log availability and evidential value depend on the actual features and operating arrangements. Official page accessed directly on 3 November 2026; relevant passages read.

16. [16] · CNIL · 14 March 2024 · Checked on 3 November 2026Security: governing maintenance and the end of life of hardware and software

    Recording maintenance, contractual safeguards and time-limited remote access followed by closure.

    Passages and scope

    Basic precautions; example maintenance clause. Personal-data security guidance. Its sample contractual clause is not a universal industrial-sector requirement. Official page accessed directly on 3 November 2026; relevant passages read.

17. [17] · NCSC and partner agencies · 14 January 2026; version 1.0 · Checked on 3 November 2026Secure connectivity for OT, principle 8: establish an isolation plan

    Isolation planning tied to continuity, critical dependencies, contracts and on-site support; targeted isolation where architecture permits.

    Passages and scope

    Principle 8; Application/service-specific isolation. The plan depends on system design and operating constraints. This analysis provides no disconnection procedure for a live system. Official page accessed directly on 3 November 2026; relevant passages read.

18. [18] · IXON · Undated page, accessed 3 November 2026 · Checked on 3 November 2026Service Accounts access tokens

    An API service account can survive its creator’s departure or deletion, and its token has no automatic expiry. Roles are configurable. It cannot approve or reject Access Requests; requests for connections protected by that feature are automatically denied.

    Passages and scope

    Required modules; Advantages of Service Accounts; Limitations of Service Accounts. An API Integrations module feature according to the vendor; access and permissions need checking for the integration. The page describes an Administrator role at creation that can be restricted. No bypass of human approvals or universal industrial-control power is inferred. Official page accessed directly on 3 November 2026; relevant passages read.