On this page
Include service devices in job preparation
A technician can have the right mechanical skills and still arrive without a device the customer permits. Diagnostic software, licences, software versions and the condition of the service laptop can affect whether the work can begin.
The Canadian Centre for Cyber Security’s industrial control systems (ICS) guidance discusses risks from compromised remote equipment and removable media, as well as authorised access and media checking. It is a security planning reference, not a U.S. rule or a guarantee that one scan makes a device safe.
Count approved capability, not the number of devices in the van
Fictional example: a service team has three laptops and two USB drives. The job requires a particular licensed diagnostic application. Only one laptop has the approved version and has completed the customer’s device process. The other four items do not provide four usable backups.
If that laptop is unavailable, the team needs a supported alternative agreed with the customer. Borrowing a personal device or bypassing the customer’s controls is not a substitute for job preparation.
| Before dispatch | Evidence to obtain |
|---|---|
| Customer device and media rules | The permitted process and named person who can answer an exception request. |
| Required diagnostic capability | Correct application/version, legitimate licence and relevant support. |
| Prepared primary and fallback | Which specific devices are ready for this job and their current availability. |
| Information left after the visit | Agreed handling of customer files, logs and access material. |
Give preparation time an owner and a budget
Include device preparation, licence administration, training and customer coordination in the service model. A low hourly labour rate can be misleading if the work cannot start or needs a second visit because the right equipment was absent.
Ask management to test the preparation process on one representative job using approved non-production information. The output is a job-readiness record with gaps, not a blanket cybersecurity certificate.
Keep the other access questions visible
Customer permission to connect does not settle export-controlled drawings, personal-data access, trade authority, work permission or machine safety. Check the actual activity separately. Keep credentials and customer information in the authorised systems; the expansion plan only needs the outstanding decision and responsible role.
Scope
- Commercial preparation using voluntary Canadian security guidance. No malware-checking procedure, safe device certification, customer access authorisation or legal permission is supplied.
Next step
Use Launch dependencies to assign the device, licence and customer-approval checks before the site visit. Record a supported fallback where the primary device is unavailable.
Sources & review notes
Canadian Centre for Cyber Security
Passage, dates and research notes
official-guidance · Main guidance: remote equipment/peripherals, authorised access, removable media and backups
Read the complete July 2021 awareness page. Its Canadian security recommendations are a planning reference, not U.S. law or a claim that scanning a device makes it safe.
Bookmark this guide or mark it as read.
Progress privacy
Saving is off by default. Without it, progress lasts only on this page. If you turn it on, this browser profile stores public content IDs and the progress you record. Anyone sharing the profile could see them. No plan inputs or contact details are included. Reset or export in learning settings.
This is a reading aid, not evidence of disclosure delivery, expertise or legal approval.