A third-party control system is an operational environment, or part of one, that an external organization operates or supports. In critical infrastructure, this can include supplier-managed software, equipment, or remote services used to monitor or control assets. The asset owner may still be responsible for ensuring the system is secure and compliant.
External involvement can complicate access control, network segmentation, logging, patching, and incident response. Attackers may exploit weak supplier access or poorly maintained components to reach operational technology; defenders reduce this risk by documenting ownership and access paths, limiting and monitoring remote connections, coordinating maintenance and response responsibilities, and verifying that security controls remain effective. Clear accountability helps operators demonstrate compliance and respond quickly when a partner-managed system becomes vulnerable.