Secure remote access for machine vendors, audit-ready under CMMC.
Machine builders and service vendors need to reach your CNCs, PLCs and HMIs. Under CMMC, each of those sessions needs a named user, MFA, a limit on what they reach and a record. This guide maps the controls and compares the ways vendors get in.
Last updated:
How do you give machine vendors remote access under CMMC?
Give each vendor a named account, MFA at a gateway you control, access to the one machine they service for a limited time, and a recording of the session. The vendor's laptop never joins your plant network.
NIST SP 800-171, which CMMC Level 2 assesses, asks for exactly that: remote sessions routed through managed access control points (3.1.14), monitored and controlled (3.1.12), protected with FIPS-validated encryption (3.1.13, 3.13.11), with MFA for users and for nonlocal maintenance (3.5.3, 3.7.5) and audit records tied to the person (3.3.2).
Trout Access Gate does this on the plant network. The vendor's VPN or 4G link only carries the connection. The session to the gate is encrypted with FIPS 140-3 validated modules, ends at Access Gate, reaches one machine, is time-limited and recorded. Nothing is installed on the machine.
Which NIST 800-171 controls apply to vendor remote access?
These are the requirements an assessor checks when a vendor reaches a machine from outside. Numbers are from NIST SP 800-171 Rev. 2, the version CMMC Level 2 uses. Two numbers are often misquoted: 3.13.13 covers mobile code and 3.13.15 covers session authenticity. Neither is the managed access point (3.1.14) or the FIPS requirement (3.13.11).
| Control | What it asks | How Access Gate meets it |
|---|---|---|
| 3.1.14 | Route remote access through managed access control points | Every vendor session ends at Access Gate. There is no other path to the machines. |
| 3.1.12, 3.1.11 | Monitor and control remote access sessions, and end sessions after a defined condition | Sessions are time-limited, close when the window ends, can be ended at any time, and are recorded for replay. |
| 3.7.5 | Require MFA for nonlocal maintenance sessions and end them when maintenance is complete | Vendor maintenance sessions need MFA at the gate and close when the maintenance window ends. |
| 3.1.5, 3.1.20 | Least privilege, and control connections from external systems | Each vendor rule names one machine. The vendor's device stays an external system and never joins the plant network. |
| 3.1.15 | Authorize remote execution of privileged commands | Per-vendor rules down to the protocol command, for example Modbus reads allowed and writes or program downloads blocked. |
| 3.5.1, 3.5.3 | Identify each user, and use MFA for network access | Named vendor accounts from your directory, MFA at the gate. No shared logins. |
| 3.1.13, 3.13.11 | Encrypt remote access sessions, with FIPS-validated cryptography | The session to the gate is encrypted with FIPS 140-3 validated modules, whatever link the vendor uses. |
| 3.3.1, 3.3.2 | Audit records traceable to each user | Every session is logged with the person, the time, the source and the machine. |
A split-tunneled vendor laptop cannot bridge the internet to your plant (3.13.7). The vendor reaches one machine through the gate's proxy and gets no address on your plant network. Machines that cannot do MFA or logging themselves are covered at the gate and documented as specialized assets or an enduring exception.
How do the common vendor access methods compare under CMMC?
Most plants already use one of these. The question for each is the same: can you show the assessor who reached which machine, when, with MFA, and what they did?
| Method | How the vendor gets in | CMMC fit |
|---|---|---|
| VPN for the vendor | The vendor's laptop joins your network through a client or site-to-site VPN. | Risky. The laptop reaches the whole segment, and the VPN logs only the connection, not the machine or what was done on it. |
| Remote desktop tools (TeamViewer, AnyDesk) | Software on an HMI or a PC, connected through the tool's cloud. | Risky. It puts vendor software on the machine and routes the session through a cloud you do not control. If CUI can pass through it, that cloud must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012. |
| Virtual desktop (VDI) in a cloud enclave | The vendor logs in to a virtual desktop in GCC High, then reaches the floor. | Partial. The vendor's laptop stays out of scope, but the path from the virtual desktop to the machine still needs its own control and log. |
| Jump host in a DMZ | The vendor logs in to a server, then connects onward to the machine. | Partial. It works when it is hardened and logged. From the jump host, the vendor often reaches the whole flat network. |
| Cloud ZTNA or just-in-time broker | The vendor signs in to a cloud broker that opens a short-lived connection to one host. | Partial. Access is per session and time-limited, but it runs through the broker's cloud, which must meet FedRAMP Moderate or equivalent if CUI can pass through it, and a connector sits inside the plant. |
| Access Gate (just-in-time access on site) | The vendor's existing VPN or 4G link carries the connection. The session ends at the gate and reaches one machine. | Meets the controls above. Named user, MFA, one machine, time-limited, recorded, with FIPS-validated encryption. |
How does Access Gate handle a vendor session?
Access Gate is an appliance on the plant network. Connect it to your existing firewall or router, and add one rule that forwards the machine traffic to Access Gate for protection and compliance.
The vendor logs in
The vendor signs in with a named account and MFA. Their VPN or 4G link only carries the connection. They get no address on your plant network.
One machine, for a set time
The rule names the vendor, the machine and the time window. The 5-axis machine builder reaches the 5-axis machine and nothing else on the line. The session closes when the window ends.
Commands are checked
Access Gate reads the industrial protocol. You can allow a vendor to read a PLC and block writes, or allow a program upload only during the maintenance window.
Everything is recorded
Each session is logged and recorded, and you can replay it. That recording is the evidence the assessor asks for under 3.1.12 and 3.3.2.
What evidence does a CMMC assessor ask for on vendor remote access?
- 1
A remote access policy
Who may connect, to which machines, with MFA, and for how long. It names vendors as a group with their own rules.
- 2
The list of vendor accounts
Each named vendor user and the machines they can reach. Access Gate exports it from the enforced policy.
- 3
Proof of MFA
The MFA configuration for remote users, and a log entry that shows it ran on a real vendor session.
- 4
Session logs and a recording
A sample vendor session with the person, the time, the machine and what was done. The assessor may ask to replay one.
- 5
FIPS validation
The CMVP certificates for the encryption on the remote path. Access Gate uses FIPS 140-3 validated modules, certificates #5441 and #5031. See FIPS validated encryption.
- 6
The SSP entry
How vendor access works, written into your System Security Plan, the document an assessor tests against the NIST SP 800-171A objectives, with the machines on the network diagram. The machines are usually specialized assets.
CMMC status
CMMC Phase II third-party assessments have been suspended since 13 July 2026. The NIST 800-171 obligation stands: the controls, the self-assessment and the SPRS affirmation still apply to contracts with CUI, including the remote access controls above.
What controlled vendor access costs
$399 per month
$780 for the appliance, then $399 per month for license and support. The first 30 days of license are free. One plant, up to 200 machines, with vendor remote access, MFA, session recording and the CMMC features included.
More plants, more machines, or enterprise support. Tell us which vendors reach your machines today and how. We show how Access Gate takes over those sessions without changing the machines.
Questions about vendor remote access under CMMC.
Yes, as transport, if it ends at a managed access control point. A VPN that drops the vendor's laptop onto your plant network fails least privilege and logs only the connection. With Access Gate, the vendor keeps their VPN or 4G link, the session ends at the gate, reaches one machine and is recorded.
Yes. NIST SP 800-171 control 3.5.3 requires MFA for network access, which covers a vendor connecting from outside. Most CNCs and PLCs cannot ask for MFA themselves, so the gateway in front of them does. Shared vendor logins fail 3.5.1.
Yes, with conditions. These tools install software on the machine or HMI and route sessions through their own cloud. If CUI can pass through that cloud, it must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012, and you still need named users, MFA and logs per session.
Write a rule that names the vendor, the machine and the window, and enforce it at a gateway in front of the machines. Access Gate applies the rule, closes the session at the end of the window and can block specific protocol commands, such as PLC writes.
Mainly 3.1.14 (route through managed access control points), 3.1.12 and 3.1.11 (monitor, control and end remote sessions), 3.7.5 (MFA for nonlocal maintenance, ended when maintenance is complete), 3.1.5 and 3.1.20 (least privilege, external connections), 3.1.15 (authorize remote privileged commands), 3.5.1 and 3.5.3 (identify users, MFA), 3.1.13 and 3.13.11 (FIPS-validated encryption) and 3.3.1 and 3.3.2 (audit records tied to each user).
Access Gate Starter costs $780 for the appliance, then $399 per month for license and support, with the first 30 days of license free. It covers one plant with up to 200 machines and includes vendor remote access, MFA and session recording.