- 1. Prepare (BifrostConnect: core role) — Zero standing privilege, brokered access and recording in place before any incident: the control baseline.
- 2. Detect (Customer-side, BifrostConnect supports) — Customer-side activity (SIEM, NDR). BifrostConnect contributes session audit logs as an input, not the detector.
- 3. Respond (BifrostConnect: core role) — Clean out-of-band access for responders over 4G/LTE, with Manager approval and the Bifrost Unit, independent of the WAN.
- 4. Recover (BifrostConnect: core role) — Forensic session recordings plus a controlled rebuild path (Manager + Bifrost Unit + AccessGuard / SessionGuard).
- 5. Learn (Customer-side, BifrostConnect supports) — Customer-side review. The audit trail and recordings feed the post-incident analysis and control improvements.
Island-Mode / Fallback Mode: Critical systems continue running in isolation; access only through BifrostConnect; remote support via 4G/Satellite; maintain operations without reopening the network.
The result: Maintain business continuity; enable remote diagnostics during containment; recover systems safely and efficiently; restore operations without exposing OT to the internet.
When the production network is down, the out-of-band path keeps essential operations running. The production WAN / IT side may be isolated or compromised and contained, with no path from the IT side to the OT island. Inside the OT island, essential operations (HMI/SCADA, PLC) continue via the Bifrost Unit, which reaches the remote responder through an out-of-band path (4G/LTE or satellite) that is independent of the WAN and outbound-only, giving a clean path with no IT transit.
Why this works: The Bifrost Unit reaches out over its own cellular path (4G/LTE or an external satellite antenna), so responders keep clean access to OT even when the production network is down. No inbound path is opened into the island, and the IT-side compromise stays contained.
Part 1 introduces a section on degraded mode operations: what should happen when the central session broker is unavailable. This section describes BifrostConnect’s concrete behaviour in each degraded scenario.
Symptom: the Bifrost Unit cannot reach the BifrostConnect Service. New session requests cannot be initiated through the standard path. Existing established sessions are tunnels that have already been negotiated end-to-end and may continue if the tunnel is stable; new sessions cannot start until the WAN is restored.
BifrostConnect behaviour: the Bifrost Unit retries the outbound connection at a configurable interval and resumes normal operation when reachability is restored. The Unit does not accept inbound connections during the outage; the OT Island Principle is preserved.
Part 1 introduces a section on degraded mode operations: what should happen when the central session broker is unavailable. This section describes BifrostConnect’s concrete behaviour in each degraded scenario.
Symptom: the Bifrost Unit cannot reach the BifrostConnect Service. New session requests cannot be initiated through the standard path. Existing established sessions are tunnels that have already been negotiated end-to-end and may continue if the tunnel is stable; new sessions cannot start until the WAN is restored.
BifrostConnect behaviour: the Bifrost Unit retries the outbound connection at a configurable interval and resumes normal operation when reachability is restored. The Unit does not accept inbound connections during the outage; the OT Island Principle is preserved.
Audit trail. Session audit is captured by the Manager/Service and forwarded to the SIEM; the Bifrost Unit retains no local audit log. Because the Service brokers every session, a session cannot be established while the Service is unreachable, so there is no un-audited degraded session.
Identity. Every session is tied to a named individual by the Manager/Service identity broker; the Bifrost Unit holds no local user store. If the Manager/Service is unreachable, a session cannot be authenticated and is not established (fail-closed).
Approval. A break-glass session requires an admin to have authorised the degraded mode in advance through Manager configuration; the Bifrost Unit does not invent its own approval.
Time-bounding. Degraded sessions expire automatically; degraded mode is not a stable operating state.
The ten sample procurement clauses in Part 1 form the contractual basis for any third-party OT access engagement with BifrostConnect. Specific clause-by-clause coverage is provided to procurement teams on request as part of the engagement onboarding process.