Access by a service provider or manufacturer, over a network, to the controller or software of an asset. Concerns cybersecurity, liability and data access.
Remote maintenance (Fernwartung) is access by a service company or manufacturer, over a network, to the controller or software of an asset, in order to read data, analyze faults, change settings or install updates. It saves trips and shortens downtime. In return, it creates a way into the asset from outside, and that access has to be regulated legally and in terms of security. Legally, it touches on cybersecurity, liability and data access.
On cybersecurity, the NIS 2 Directive requires essential and important entities to take risk management measures, which include supply chain security, among them security-related aspects of relationships with direct suppliers and service providers (Article 21(2), point (d)). A service company with remote access to assets is part of that supply chain. The manufacturers of connected components are subject to the Cyber Resilience Act. On data access, the Data Act regulates who may use and pass on the data generated through use. In Germany, the BSI, the Federal Office for Information Security, is responsible for NIS 2.
For operators, this is mainly a contract matter. Regulate who may connect when and how, whether each session has to be released, how access is logged, who informs whom after a security incident, and who is liable for damage from misconfiguration or outside access. Also check billing: if remote time is billed at an hourly rate, ask for proof of remote access too, with date, duration, purpose and changes. Remote access that changes safety functions also belongs in the risk assessment and can be a modification that requires an inspection.
What matters
- Record for each asset who has remote access, through which route and with which rights.
- Agree on release per session or fixed time windows, and on logging of access.
- Regulate reporting channels and deadlines for security incidents.
- Ask for proof of every access and compare it with the invoices.
- Clarify whether the access involves data you are entitled to under the Data Act, and whether passing it on to third parties is regulated.
Suppose an operator gives a service company remote access to the building management system. The contract says only that the company has access. The operator adds: access only after release by a contact person, a log of every session with duration and changes, reporting of anomalies within an agreed time, and deletion of the credentials when the contract ends.
In the original wording
“supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”