Scenario Implementation – Scenario 1

Part 1 defines four scenarios derived from two axes: where the programming software is located (engineering station vs vendor PC) and the scale of the OT operation (small with no SOC vs large with SOC, PAM, SIEM). Each scenario maps to a specific BifrostConnect product mix.The figure below shows the four implementations side by side. The detailed configuration for each scenario follows in the next four sections.

Part 1 requirement recap: Small utility, two IT staff, standalone engineering station with PLC programming software. Vendor needs screen-level access. No AD, no server infrastructure, no security staff. Security must be architectural.

BifrostConnect implementation. Minimum-viable floor: AccessGuard, installed directly on the engineering station and reached over the site’s existing remote-access path. The configuration below details this floor; the canonical best-practice target adds an unattended Bifrost Unit at the boundary (see Recommended hardening, below).

Configuration:

• AccessGuard agent installed on the Windows engineering station (Windows XP SP3+ to Windows 11 (incl. Server 2003+), 2 GB RAM free, port 7531).
• Localhost-only binding (127.0.0.1:7531). No network exposure of the agent.
• Mandatory TOTP enrolment for every vendor technician account. TOTP cannot be disabled.
• Application launch scope: only the programming software the vendor needs. No general shell or Explorer access.
• H.264 session recording enabled by default. Recordings encrypted at rest using Windows DPAPI.
• Recordings stored locally on the OT network. No cloud dependency.
• Time-window configured per vendor engagement. Access expires automatically at the end of the window.

Compliance evidence mapping (Part 1, Scenario 1 regulatory alignment):

Implementation requirements for Scenario 1. Deploy AccessGuard with the following operational decisions in mind so the control envelope is what is documented in compliance evidence:

• Network connectivity: AccessGuard is designed to reach the engineering station over the OT network. For fully air-gapped stations, plan vendor work either on-site or via a Bifrost Unit out-of-band path (see Scenario 3) – both produce equivalent recording and identity evidence.
• Delivery channel discipline: AccessGuard is the only authorised vendor delivery path. KVM switches, TeamViewer and AnyDesk are out of scope; remove or block them as part of the access policy so the recorded path is the only path.
• Station-level vs network-level isolation: AccessGuard is the application-and-recording control on the station. Pair it with a station-level network segmentation (VLAN or local firewall) so a compromised station cannot reach other OT assets. The two controls together close the boundary.

Recommended hardening: add a Bifrost Unit at the boundary. Where AccessGuard is paired with an existing remote-access path, it delivers the Scenario 1 minimum viable control envelope as a compensating posture. For organisations that want a stronger boundary – for example sites that handle drinking water, district heating, or other critical infrastructure where the regulator looks for hardware-enforced segmentation – adding an unattended Bifrost Unit at the boundary of the engineering station’s network is the recommended next step (the canonical Scenario 1 best-practice combination). The Unit gives you outbound-only OT posture, an out-of-band 4G/LTE access path for incident response, and the option to add SessionGuard recording later without re-architecting.

The canonical Scenario 1 best-practice combination is Direct Tunnel Access + AccessGuard + Bifrost Manager + an unattended Bifrost Unit at the boundary. AccessGuard with disciplined operational controls and an existing remote-access path satisfies NIS2 Art. 21(2)(d), (i), (j); BEK 260 §§29-32 (supplier procedures and remote-access procedures for direct suppliers); and BEK 260 §§51-53 and §55 stk. 2 (access control, MFA, time-bounded remote access) as a compensating posture; the full combination is the recommended target.

Maturity profile: minimum viable vs target state (Scenario 1). The table below distinguishes the floor (what the guide treats as required) from the ceiling (what mature deployments aim for). Read the guide’s recommendations as a floor, not a ceiling: hitting minimum viable closes the audit gap; reaching target state is the operationally-resilient deployment.