--- title: Access Governance in Critical Infrastructure description: Why critical infrastructure must govern physical, digital and supplier access as one lifecycle - illustrated by real incidents and attack scenarios. image: https://key2xs.com/hubfs/key2xs-statement-20261112-0943.png --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=nl) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) Industries [Government](https://key2xs.com/sectors/government?hsLang=nl) [Utilities](https://key2xs.com/sectors/utilities?hsLang=nl) [Water management](https://key2xs.com/sectors/water-management?hsLang=nl) [Transport](https://key2xs.com/sectors/transport?hsLang=nl) [Telecom](https://key2xs.com/sectors/telecom?hsLang=nl) Platform [Product](https://key2xs.com/products?hsLang=nl) [How it works](https://key2xs.com/?hsLang=nl#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=nl) [One Identity](https://key2xs.com/partners/one-identity?hsLang=nl) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=nl) [Okta](https://key2xs.com/partners/okta?hsLang=nl) [OpenText](https://key2xs.com/partners/opentext?hsLang=nl) [iLOQ](https://key2xs.com/partners/iloq?hsLang=nl) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=nl) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=nl) Resources [Resource center](https://key2xs.com/resources?hsLang=nl) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) [Events](https://key2xs.com/events?hsLang=nl) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=nl) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=nl) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) [FAQ](https://key2xs.com/?hsLang=nl#faq) [News](https://key2xs.com/news-archive?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) [← The Key2XS journal](https://key2xs.com/news-archive?hsLang=nl) Physical Access Governance # Access Governance in Critical Infrastructure Nov 12, 2026 · 11 min read · by the Key2XS team ![Physical Access Governance](https://key2xs.com/hubfs/key2xs-statement-20261112-0943.png) *In critical infrastructure, a valid key, badge or account can still represent invalid access. Real incidents show why identity, physical access, OT privileges and third-party access must be governed as one lifecycle.* The most dangerous credential in critical infrastructure is not always stolen or forged. It may be completely valid, issued to a real person, accepted by the lock and visible in a log, yet no longer justified by that person's role, assignment or employment status. That is the difference between access control and access governance. Access control asks whether a credential works. Access governance asks whether the person should still have that access, at that location, at that moment and for that purpose. In environments that provide electricity, drinking water, transport, healthcare or digital connectivity, the distinction can determine whether an isolated security weakness becomes a safety incident or service disruption. ## One Identity and Several Routes to the Same Critical Asset A technician entering a substation may use an electronic key at the perimeter, a badge inside the building, an account on an engineering workstation and a privileged credential to reach operational technology. A maintenance supplier may also connect remotely through a VPN or support platform. These controls are often managed by different teams and systems. Human Resources knows whether the person is still employed. Procurement knows whether the contract remains active. The Identity Governance and Administration system manages digital entitlements. Facilities manages keys and badges. The OT team manages engineering access. A visitor system records temporary entry. Each may hold a correct but incomplete version of the truth. Access governance connects those fragments. It answers a larger set of questions than a lock or login screen can answer alone: - Who is the person or service requesting access? - Which current role, task or contract justifies it? - Which site, zone, system or device is genuinely required? - Who approved the entitlement, and can that approval be verified? - When should access begin and expire? - What changes when the person moves role, changes employer or finishes an assignment? - Was the access actually used, and can the complete decision be reconstructed afterwards? - the employee moved to another role; - the contractor's assignment ended; - the approval covered a different site; - emergency access never expired; - the credential was never returned; - the account still exists in a legacy environment; - the visitor entered outside the authorised maintenance window; or - two individually legitimate permissions created a dangerous combination. - one identity can be traced across physical and digital access systems; - access is tied to a current role, assignment, sponsor or contract; - permissions are limited by site, zone, system, purpose and time; - high-impact entitlements require separation of duties or two-person approval; - joiner, mover and leaver events update every relevant credential; - contractor and supplier access has an owner and automatic expiry; - emergency access expires and is reviewed afterwards; - offline and degraded modes have defined security behaviour; - physical, identity and OT events can be correlated during monitoring and investigation; and - periodic review confirms that an entitlement is still necessary, not merely that it once received approval. In critical infrastructure, this scope has to include four connected layers: physical access, logical access, privileged OT access and supplier access. **The four layers of access governance**   ![Scherm­afbeelding 2026-11-12 om 09.51.19](https://key2xs.com/hs-fs/hubfs/Scherm%C2%ADafbeelding%202026-11-12%20om%2009.51.19.png?width=1624&height=540&name=Scherm%C2%ADafbeelding%202026-11-12%20om%2009.51.19.png) ## Real Incidents When Access Outlives Authority Documented incidents show that attackers do not always need to break a sophisticated security control. Sometimes an old account, an exposed controller or specialist knowledge retained after a working relationship ends is enough. ### A former employee and a water plant remote login ##### **DOCUMENTED INCIDENT** In January 2019, an employee of the Post Rock Rural Water District in Kansas resigned. His former duties had included monitoring the plant after hours through a remote-login system. Two months later, that remote system was used to shut down the plant and turn off one of its filters. Investigators linked the intrusion to the former employee's phone, and he later pleaded guilty to water-facility tampering and reckless damage during unauthorised computer access. [The US Department of Justice documented the case](https://www.justice.gov/usao-ks/pr/kansas-man-pleads-guilty-water-facility-tampering). The important detail is not the technical sophistication of the intrusion. It is the gap between employment status and operational access. A leaver process had occurred in the organisation, but the authority to reach a live water system had not disappeared with it. ### A dormant VPN profile and a pipeline shutdown ##### **DOCUMENTED INCIDENT** The 2021 Colonial Pipeline ransomware incident began through a legacy VPN profile that was not intended to remain in use. Congressional evidence found that the attacker used an employee username and password and that the profile did not require a one-time passcode. Although the ransomware affected business systems, Colonial shut down pipeline operations as a precaution on 7 May and restarted the full system on 13 May. The disruption affected fuel supply across parts of the eastern United States. [Mandiant documented the access path in evidence submitted to Congress](https://www.congress.gov/117/meeting/house/112689/witnesses/HHRG-117-HM00-Wstate-CarmakalC-20210609.pdf), while the [US Department of Energy recorded the operational response](https://www.energy.gov/ceser/colonial-pipeline-cyber-incident). This was an identity-lifecycle failure with consequences far beyond the account itself. An access inventory is incomplete if it omits old VPN profiles, service accounts, emergency paths and other routes that sit outside the main identity platform. ### Specialist knowledge survived the supplier relationship ##### **DOCUMENTED INCIDENT** In the 2000 Maroochy Shire incident in Australia, a former employee of a control-system supplier used radio equipment and specialist knowledge to manipulate a sewage-control system on dozens of occasions. Approximately 264,000 gallons of untreated sewage were released into rivers and parks. [The US Government Accountability Office included the incident in its review of critical-infrastructure control-system security](https://www.gao.gov/assets/a268145.html). The incident remains relevant because supplier offboarding is broader than disabling a username. Engineering tools, radio paths, configuration knowledge, physical equipment and undocumented support methods can all survive the commercial relationship. ### Internet Facing Controllers and Repeated Third Party Configurations ##### **DOCUMENTED INCIDENT** In July 2026, water and wastewater utilities in at least seven US states reported attacks on internet-facing programmable logic controllers. The attackers changed IP addresses and passwords, causing loss of monitoring and control. Reported operational effects included loss of pressure and flooding. The FBI and Environmental Protection Agency also noted similar network configurations supplied by third parties across several victims, potentially allowing the attackers to repeat the same technique at scale. [The joint FBI-EPA warning describes the incidents and their operational effects](https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions). Here, access governance extends to machine identities, device passwords, remote-support routes and installer configurations. The question is not only which person can enter a control room. It is also which devices and external networks are allowed to communicate with the controller, under whose authority and with what evidence. ### Physical infrastructure does not need a login screen to be attacked ##### **DOCUMENTED INCIDENT** The April 2013 attack on the Metcalf electrical substation in California used rifles rather than malware. Seventeen transformers were damaged. The incident helped prompt a mandatory physical-security reliability standard for parts of the US bulk-power system. [The Federal Energy Regulatory Commission summarised the attack and its regulatory significance](https://www.ferc.gov/news-events/news/commissioner-bernard-l-mcnamee-concurrence-regarding-complaint-michael-mabee). The lesson is that access governance cannot end at the badge reader. Critical sites include fences, remote cabinets, cable routes, maintenance ports and equipment that may be reachable without opening a conventional door. Zoning, perimeter detection, time restrictions and response procedures are part of the same access problem. ## Composite Attack Scenarios The following scenarios are hypothetical composites based on common control failures. They are not accounts of specific incidents, but they illustrate how physical and digital access can combine in practice. ### Scenario 1 The Contractor Who Never Really Left ##### **HYPOTHETICAL COMPOSITE** A specialist receives six weeks of access to several substations. When the assignment ends, the account in the contractor portal is closed, but an electronic key remains active because the key-management environment is not connected to the identity lifecycle. Months later, the former contractor - or someone using the unreturned key - enters a remote site during an unstaffed period. The lock accepts the key because the credential is authentic. The system does not know that the business relationship behind it has ended. Once inside, the intruder can reach network cabinets, engineering workstations and maintenance interfaces. The failure is not authentication. It is the absence of a shared expiry rule across the contract, identity and physical credential. ### Scenario 2 A Legitimate Maintenance Visit Becomes an OT Foothold ##### **HYPOTHETICAL COMPOSITE** An attacker compromises a supplier's email account and learns the timing of planned maintenance at a water-treatment facility. Posing as a replacement technician, the attacker presents a plausible work order and is admitted to the site. The visitor receives access to the correct building, but not to a narrowly defined room and time window. The attacker connects a small device to an inadequately protected maintenance port. The physical-access event and subsequent network anomaly are stored in separate systems, so the relationship between them is not immediately visible. The failure is access based on apparent affiliation rather than a verified assignment, named sponsor, authorised zone and constrained duration. ### Scenario 3 The Mover Who Accumulated Access ##### **HYPOTHETICAL COMPOSITE** A technician works successively in three regions. Each transfer adds permissions for new locations, but previous rights are never removed. After several years, the technician can enter substations, depots and control rooms far beyond the current job scope. The account is later compromised through phishing. The attacker does not need to defeat the physical-access system; years of accumulated privileges already provide a wide operational footprint. Every entitlement was approved at some point, so no individual record looks obviously illegitimate. The failure is treating onboarding as a controlled process while allowing role changes to become permanent privilege accumulation. ### Scenario 4 Cyber to Physical Privilege Escalation ##### **HYPOTHETICAL COMPOSITE** An attacker compromises an administrative account used by the integration between an identity platform and a physical-access system. Instead of forcing a door, the attacker creates an entitlement, assigns it to a controlled mobile credential and schedules entry during a quiet maintenance window. To the reader, the credential is valid. To the monitoring system, the event looks like an authorised visit. If one administrator can request, approve and provision the change, there may be no independent control capable of detecting it. The failure is overlooking the integration itself as a high-value security control plane. Once physical rights are provisioned digitally, the provisioning path becomes part of the physical perimeter. ### Scenario 5 The Attacker Manufactures an Offline State ##### **HYPOTHETICAL COMPOSITE** A communications outage leaves electronic locks operating on cached permissions. This is an intentional availability feature: staff must still be able to reach equipment during a network failure. However, a centrally revoked credential remains valid at the isolated site until the door reconnects. An attacker who understands this design first disrupts communications and then uses the revoked credential. The system behaves exactly as designed, but the operational fallback becomes the attack path. The failure is treating offline behaviour as a technical setting rather than a governed security state with explicit limits on credential age, revocation latency and permitted zones. ## Why conventional access control is not enough Traditional access systems make local decisions well. A reader checks a badge. A lock checks a key. A directory validates an account. A privileged-access tool releases an administrative credential. Problems emerge in the space between those decisions. An access event can be technically valid while being organisationally wrong: Logs alone do not solve this. A door log proves that a credential was accepted. It does not necessarily prove who used it, why the person was entitled to enter or whether the approval remained valid. Auditability requires a chain connecting identity, role, request, approval, credential, use and revocation. ## Access governance is now a resilience requirement European regulation increasingly treats physical and digital access as related resilience controls. The NIS2 Directive requires covered organisations to address human-resources security, access-control policies, asset management and, where appropriate, multifactor authentication. The Critical Entities Resilience Directive requires proportionate physical protection, including perimeter controls, detection and access control, together with measures concerning personnel and external service providers. [NIS2 Article 21](https://eur-lex.europa.eu/eli/dir/2022/2555/oj?locale=en) and [CER Article 13](https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng) establish the respective cyber and physical resilience frameworks. The European Commission's 2026 CER guidance goes further in practical terms. It describes layered security zones and encourages a single authoritative register for physical keys and electronic credentials, including issuance, revocation and return dates. It also addresses least privilege, periodic review, visitor control and deactivation when a person leaves. [The Commission guidance is available through EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026XC03712). In the Netherlands, the Cyberbeveiligingswet and Wet weerbaarheid kritieke entiteiten entered into force on 15 August 2026, implementing NIS2 and CER respectively. The first focuses on digital resilience; the second addresses the broader resilience of formally designated critical entities. [The Dutch government describes their scope and entry into force](https://www.rijksoverheid.nl/actueel/nieuws/2026/07/07/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-15-augustus-2026-van-kracht). The regulatory direction is clear: facilities security, IAM, OT security, HR and supplier management can no longer operate as isolated disciplines. ## What governed access looks like Governed access turns a key, badge, mobile credential or account into the technical expression of a current business decision. In practice, that means: None of these controls is new in isolation. The change is to manage them as one lifecycle rather than as independent administrative tasks. ## A valid credential is not proof of legitimate authority Critical infrastructure cannot rely on technical validity alone. A key may open the correct lock. A badge may belong to a known employee. A VPN password may be correct. A supplier may have supported the same system for years. None of those facts proves that the access is still justified now. The decisive question is therefore not simply, "Did the door open?" It is: "Was this identity still entitled to reach this asset, at this time, for this purpose - and can the organisation prove why?" That is the role of access governance: turning fragmented access controls into a continuous, auditable defence for the services society cannot afford to lose. *This article distinguishes documented incidents from hypothetical composite scenarios. It provides a general security and regulatory analysis and is not legal advice.* ![](https://key2xs.com/hubfs/1587550138006.jpeg)![](https://key2xs.com/hubfs/img/niels-bakker.png)![](https://key2xs.com/hubfs/1746630921693.jpeg)![](https://key2xs.com/hubfs/1696359051569.jpeg) **Written by the Key2XS team** Key2XS is founder-run. Questions about this piece land with the people who built the platform. [Talk to us](https://key2xs.com/contact?hsLang=nl). ## Keep reading ## Govern the keys you already have See identity, policy and physical keys in one 30-minute demo, scoped to your estate. [Book a demo](https://key2xs.com/contact?hsLang=nl) [More in the journal](https://key2xs.com/news-archive?hsLang=nl) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) - [Product](https://key2xs.com/products?hsLang=nl) - [Integrations](https://key2xs.com/integrations?hsLang=nl) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=nl) - [Resource center](https://key2xs.com/resources?hsLang=nl) - [Events](https://key2xs.com/events?hsLang=nl) - [News](https://key2xs.com/news-archive?hsLang=nl) - [Contact](https://key2xs.com/contact?hsLang=nl) [![ISO/IEC 27001 certified by EIK Certificering](https://key2xs.com/hubfs/img/badges/iso-27001-certified-key2xs.svg)](https://www.eikcertificering.nl/certificatieregister/key2xs-b-v/) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=nl) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=nl) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Key2XS", "url" : "https://key2xs.com/news/author/key2xs-2" }, "dateModified" : "2026-11-12T08:59:45.775Z", "datePublished" : "2026-11-12T08:59:45.000Z", "headline" : "Access Governance in Critical Infrastructure", "image" : [ "https://key2xs.com/hubfs/key2xs-statement-20261112-0943.png" ], "mainEntityOfPage" : { "@id" : "https://key2xs.com/news/access-governance-in-critical-infrastructure", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://key2xs.com/hubfs/logo%20blue.svg" }, "name" : "Key2XS B.V." } } ```