Identity for Manufacturing

The job identity does in manufacturing

Manufacturing identity spans two worlds. The IT side looks like any enterprise: a global workforce, a service desk, ERP and SaaS. The operational technology (OT) side has shared operator workstations, engineering laptops with local accounts, controllers with default credentials, and machine builders who need remote access. Downtime drives every decision, so controls must protect production without stopping it.

Manufacturing accounts for 2 of the 123 incidents in the Identity Breach Database (1.6%). Both were 2023 extortion attacks, and in both MFA was bypassed, not absent: one attacker talked the service desk into resetting it, the other stole a session that had already passed it.

The identity threat picture, from the incident record

Password and MFA resets given away on the phone. Clorox disclosed in an August 2023 8-K that an attack had damaged parts of its IT infrastructure, causing widescale disruption and product shortages. In its July 2025 lawsuit against its help desk provider Cognizant, Clorox alleges an attacker posing as an employee called the outsourced service desk and was given password and MFA resets without identity verification, citing call transcripts. Clorox is seeking about $380 million, which Cognizant disputes. Its FY2024 10-K reported about $29 million of incremental costs net of $30 million in insurance recoveries. Press coverage tied it to Scattered Spider and its help desk social engineering.

A stolen session from a remote access appliance. A joint CISA, FBI, MS-ISAC and ACSC advisory stated that LockBit 3.0 affiliates exploited Citrix Bleed (CVE-2023-4966) to gain initial access to Boeing Distribution. The flaw let attackers read valid NetScaler session tokens from memory and reuse them without a password or MFA. Patching alone did not evict them: every existing session had to be killed, because already-stolen tokens stayed valid. See session cookie theft and token replay.

In both cases the attacker came in through enterprise identity, the reset path and the remote access edge, not the plant network.

The regulatory floor

IEC 62443 is the industrial control system security series. ISA lists its parts, including 2-1 (security program requirements for asset owners), 2-4 (requirements for service providers), 3-3 (system security requirements and security levels) and 4-2 (technical requirements for components). IEC 62443-4-2, published 27 February 2019, ties component requirements to seven foundational requirements, the first two being identification and authentication control and use control. Cite Part 2-4 in contracts with integrators and machine builders.
NIS2. Annex II brings six manufacturing subsectors into scope: medical devices and in vitro diagnostics; computer, electronic and optical products; electrical equipment; machinery and equipment n.e.c.; motor vehicles, trailers and semi-trailers; and other transport equipment (NACE C26 to C30). Article 21(2) requires "access control policies" and "the use of multi-factor authentication or continuous authentication solutions... where appropriate." Important entities face fines of a maximum of at least EUR 7 million or 1.4% of worldwide turnover. See identity controls for NIS2.
CMMC 2.0 for defense manufacturing. The DFARS CMMC rule took effect on 10 November 2025, and Phase 2 begins on 10 November 2026, when DoD intends to require Level 2 third-party (C3PAO) certification in applicable contracts. Level 2 maps to NIST SP 800-171 Rev 2, whose requirement 3.5.3 reads: "Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts." Requirement 3.5.4 adds replay-resistant authentication. Shop-floor systems that touch CUI are in scope.
Cyber Resilience Act. Manufacturers of products with digital elements sold in the EU have had to report actively exploited vulnerabilities since 11 September 2026. From 11 December 2027, the essential requirements, including protection against unauthorised access through authentication and identity management, apply to what you ship. See the Cyber Resilience Act.

OT, shared workstation and contractor identity

Account type	Why it exists	What to do
Shared HMI and operator logins	Shifts hand over a running line; a lockout can stop production	Keep shared accounts where operations require them, log positive user identification, and change the secret when anyone with knowledge of it leaves
Engineering workstation local admins	Programming tools run offline on the plant network	Vault the credentials in PAM, rotate after use, and record sessions
Default device credentials	Controllers and switches ship with them	Inventory and change them at commissioning
Machine-builder and integrator remote access	Warranty and support on specialist equipment	Brokered, recorded sessions with just-in-time access; no standing VPN accounts
Service accounts and certificates	Historians, MES and connected equipment talk to each other	Certificate lifecycle automation and a non-human identity inventory
Outsourced service desk	Password and MFA resets for the whole workforce	Verification that a caller cannot pass with facts from a directory or LinkedIn

The identity controls that matter most

Verified resets, wherever the desk is. Require identity verification or a manager callback for every password and MFA reset, notify the user and manager, and write the procedure into outsourcing contracts. See account recovery.
Kill sessions, not just patch, on edge devices. After any VPN or gateway authentication flaw, revoke every active session and rotate the credentials the device could reach. Prefer ZTNA that checks identity and device continuously.
Broker all vendor access into OT. One recorded path, approved per session, with MFA on the broker even where the controller itself cannot do MFA.
Phishing-resistant MFA for privileged and remote users. It meets NIST SP 800-171 3.5.3 and removes codes a caller can ask for. See phishing-resistant MFA.
Separate IT and OT identity. Plant systems should not trust the corporate domain for administration. Compromise of a corporate account should not reach the control network. See microsegmentation.
Automate machine identity. Expired certificates cause downtime as well as risk. See the certificate lifecycle management guide.

Vendors and fit

Privileged and OT remote access: Idira (formerly CyberArk) and BeyondTrust for vaulting and session recording; WALLIX has an OT and industrial focus and EU data residency. See best PAM for enterprises and best compliant PAM platforms.
MFA where agents cannot go: Silverfort extends MFA to legacy systems, service accounts and OT without agents.
Workforce identity: Microsoft Entra ID or Okta, with SailPoint for supplier and contractor certification. See best IAM for enterprises.
Machine and device PKI: Keyfactor or DigiCert. See best machine identity for enterprises.
Zero trust access: Appgate for self-hosted deployments in OT and critical infrastructure, or Zscaler. See best zero trust tools.

Background: identity for manufacturing.

Common pitfalls

Outsourced service desks that reset MFA on a phone call.
Patching a remote access appliance without revoking stolen sessions.
Machine-builder VPN accounts left enabled between support visits.
Flat networks where a compromised workstation reaches the plant floor.

Where it is heading

CMMC Phase 2 makes third-party-assessed MFA a condition of defense work from November 2026, and the Cyber Resilience Act makes authentication a product requirement for connected goods sold in the EU from December 2027.

Frequently asked questions

How did attackers get into Clorox?

According to Clorox's July 2025 lawsuit, an attacker posing as an employee called the Cognizant-run service desk and was given password and MFA resets without identity verification. Cognizant disputes the claims.

Does CMMC require MFA?

Yes, at Level 2. It maps to NIST SP 800-171 Rev 2, and requirement 3.5.3 requires MFA for local and network access to privileged accounts and for network access to non-privileged accounts.

Which manufacturers does NIS2 cover?

It covers makers of medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment, subject to size thresholds.

Can OT systems use MFA?

Many controllers and HMIs cannot. Put MFA on the jump host, PAM broker or ZTNA gateway in front of them, and record the session.