---
title: Residual Risks
description: "RESIDUAL RISKS: UNSOLVABLE BY TECHNOLOGY ALONE What residual risks cannot be solved by technology alone in third-party OT access programmes? The pattern in this guide is complete at the architectural level. It is not complete at the programme level. A…"
url: "https://bifrostconnect.com/knowledge-center/residual-risks/"
updated: "2026-07-10"
category: Best Practice Guide
---

# Residual Risks

RESIDUAL RISKS: UNSOLVABLE BY TECHNOLOGY ALONE What residual risks cannot be solved by technology alone in third-party OT access programmes? The pattern in this guide is complete at the architectural level. It is not complete at the programme level. A set of residual risks sits outside what technology can address on its own; they require procedural, contractual, or organisational controls and should be named explicitly so they are not silently assumed away.

- Insider threat from vendor personnel. A technician with legitimate, approved access still has that access during the approved window, and the case includes a disgruntled or departing insider acting deliberately. Controls: background checks where allowed by national law, role separation within the vendor organisation, two-person rules for high-risk work, and contract clauses that require the vendor to report personnel changes.
- Geopolitical supply-chain risk. The vendor's own national jurisdiction, ownership structure, and exposure to state pressure are not addressable through session controls. Controls: vendor due diligence, national origin of key components, alternative-supplier continuity planning. NIS2 Article 21(3) requires entities to take into account vulnerabilities specific to each direct supplier and service provider, and the overall quality of their products and practices.
- Social engineering against asset-owner personnel. A well-designed session architecture can still be defeated by a phone call that causes a site operator to approve a session that should not have been approved. Controls: security awareness training, separation of approval authority from the requester's chain of contact, out-of-band verification for unexpected requests.
- Contractual enforceability at the moment of breach. A service-level agreement without enforceable remedy is not a control. Controls: clause drafting that creates specific obligations with measurable breach conditions, liability caps calibrated to the actual potential harm, and jurisdiction clauses that allow enforcement in the asset owner's home forum.

 *The message is not that technology fails; the message is that a technical pattern plus a programme is the whole answer, and presenting the technical pattern alone would misstate the completeness of the defence.*