Who may connect remotely to your U.S. customer’s machine?

Start with the work the customer is buying

A local distributor may sell installation and maintenance while an overseas engineer supplies specialist help. That arrangement creates a practical question: which machine functions and information does the engineer need for this job? A general promise of remote support does not answer it.

The operational technology (OT) security guide from the National Institute of Standards and Technology (NIST) recommends justified, limited remote access, monitoring and removal when it is no longer needed. It also warns that remote access must preserve safety and security controls. These are technical recommendations to evaluate with the customer’s qualified team, not a universal U.S. access licence.

Sources: National Institute of Standards and Technology: Sections 6.1.1,6.2.4.3,6.2.10–11 and 3.3.8–9; printedpp 91,112–113,122–125 and 42–43

A useful permission describes one bounded session

Fictional example: a customer authorises a diagnostic session on Tuesday from 14:00 to 15:30 in the plant’s local time. Its local engineer stays responsible for the machine. During the session, the overseas specialist identifies a possible software change that was not included in the approved task.

The planning response is to record the finding and seek the relevant change approval. Extending a diagnosis into a change without the agreed approval could create an unpriced customer problem. Your qualified personnel choose the technical controls; this example gives no connection or repair instructions.

Include the approval and closing work in the support budget

Someone must arrange the customer window, check the approved account, remain available locally and review closure. Those tasks consume time even when the diagnostic work is short. Include them in parent support and local service costs rather than assuming the engineer’s connection time is the whole job.

Ask management for a rehearsal using an authorised test environment and no customer production data. The evidence you want is the request, approval, activity record and closing check. A screenshot of a successful login establishes much less.

Resolve the missing permission before offering the service

Keep passwords, network diagrams and customer access records in approved systems. In the expansion brief, record only the responsible roles, the open decision and the cost of the proposed support process. Customer contracts, data access, export controls and sector rules still need their actual checks.