Vendor Closeout Gate
Problem
Integrator VPNs and jump-box logins stay live after the job. CISA tells operators to document remote access and disable dormant accounts. Most sites cannot show that closeout.
What it solves
A register of who could reach the environment and whether that path is still open.
How
Inventory of vendor remote paths. Standing vs time-boxed. MFA yes or no. A closeout record. Read-only. We do not take over your access tools.
The issue, in public sources
CISA: secure remote access to OT, least privilege, disable dormant accounts