An engineer may arrive to replace a controller, restore a configuration or install a manufacturer-approved update. The work has been authorised, the visitor has signed in and the production window is booked. Yet the files needed for the job may have passed through several computers and removable drives before reaching the factory floor.
The difficulty is not simply deciding whether an engineer is trustworthy. It is establishing whether the information, equipment and transfer method used during the visit are appropriate for the system being maintained. That distinction deserves its own place in industrial change control.
A Legitimate Visit Can Still Introduce an Untrusted File
Industrial facilities routinely depend on specialist third parties. A machine supplier may maintain a programmable logic controller, while another contractor supports a human-machine interface or an engineering workstation. These tasks can require software packages, configuration backups, diagnostic files and firmware updates. Some travel through managed networks. Others arrive on portable storage because the target equipment is isolated or does not support modern connectivity.
Authorising the maintenance visit confirms a business need, not the safety of every file. A contractor might have downloaded an update onto a general-purpose laptop, copied it to a drive used at other sites and then brought it into the plant. None of those actions necessarily indicates wrongdoing. Each does, however, introduce another point where provenance, integrity or malware checks could be lost.
Map the Entire Maintenance Handover
Start with a practical question: how does a file travel from its original source to the equipment that will use it? Record the supplier, the person requesting the work, the device used to carry the file, any intermediate computer and the final destination. Include the return journey when logs or production data must leave the site.
This mapping helps reveal gaps that a network diagram may miss. A factory can invest heavily in industrial control systems security while leaving routine physical file movements poorly documented. A restricted network may have no direct internet access, but a removable device can still carry content across the boundary. The appropriate controls therefore depend on both the destination system and the route taken to reach it.
Make Transfer Rules Part of Change Control
Maintenance authorisation should specify more than the engineer’s arrival time. It should identify which files are expected, where they originated, who will approve the transfer and what constitutes a successful check. Where a supplier provides a digital signature or checksum, verify it through a trusted source rather than trusting a value supplied alongside the file.
Agree the permitted device types before the visit. Wherever possible, use organisation-provisioned media with a clear owner instead of accepting an unknown personal drive. Limit each transfer to what is required for the approved task. A full collection of supplier folders is harder to assess and creates unnecessary copies of information that the plant may have no reason to retain.
Separate Inspection From Production Equipment
A sensitive controller or engineering workstation should not become the first place an unfamiliar drive is examined. Dedicated inspection points allow approved media to be checked before it reaches operational equipment. In facilities with regular physical transfers, USB cyber security white stations can provide an isolated scanning step within an established authorisation process.
The purpose of that checkpoint is risk reduction, not a promise that a scan proves a device harmless. Malware detection can miss new or unusual threats, and a device that imitates a keyboard presents a different risk from a malicious document. Appropriate device restrictions, source verification and application controls still matter. If a transfer fails inspection or cannot be assessed, the process must stop or move to a documented exception route.
Design an Emergency Route That Does Not Encourage Shortcuts
Industrial sites sometimes face urgent repair decisions. When a line is stopped, production pressure can make a rejected transfer feel more costly than the security risk. A policy that simply says ‘never use external drives’ is unlikely to help if engineers have no workable alternative.
Define an escalation route before that situation arises. Name who can authorise an exception, what additional isolation or verification is required and how the decision will be recorded. Keep emergency media available where appropriate, and rehearse the procedure with maintenance and security teams. Speed should come from preparation rather than bypassing safeguards.
Keep Evidence That Explains the Decision
A useful maintenance record tells a clear story. It identifies the change request, the source of the file, the staff who approved its movement, the destination equipment, the checks performed and the outcome. Preserve enough information to investigate a later problem without collecting unnecessary personal data.
This matters when several suppliers visit the same site. If an unusual controller behaviour appears weeks later, a reliable history can help distinguish authorised updates from unexpected activity. It can also show whether the same removable device moved between production zones or whether a rejected file was subsequently reintroduced.
Review Whether the Process Works in Practice
After implementation, ask engineers where the process causes delays. Are scanning points available near the work? Can approved file types be inspected? Are suppliers told the requirements before arriving? Do night shifts know who can approve exceptions? These details determine whether a control is consistently used.
Useful measures include the proportion of transfers linked to approved work, incomplete records, recurring exceptions and the time required to resolve a rejected file. A high scanning count alone does not demonstrate security. The stronger test is whether the site can show that the right file reached the right system through an approved route.
A Better Handover Protects Both Security and Uptime
Third-party maintenance is essential to reliable industrial operations. The goal is not to obstruct engineers or treat every supplier as a threat. It is to ensure that a valid job does not automatically grant trust to every device and file used to complete it. When file provenance, inspection, approval and record keeping are built into ordinary maintenance, security becomes part of a dependable handover rather than a last-minute obstacle.