Ask anyone who runs a data center what keeps them up at night and you’ll get a familiar list: power, cooling, redundancy, uptime. Maybe a generator that didn’t start during the last load test. Those are the right worries. They’re just not the whole list.
Here’s the one I’d add. Every one of those facilities has a small army of people who can reach into it from somewhere else. The UPS vendor. The chiller OEM. The BMS integrator who set things up four years ago and, as far as anyone can tell, still has a way in. Remote access has quietly become part of how data centers run, and in a lot of places it’s governed about as tightly as the break room fridge.
On July 16, 2026, the stakes went up. FERC directed NERC to write reliability standards for large computational loads (regulator-speak for data centers, crypto mines, and their power-hungry cousins) and to set registration criteria for who has to follow them, with both due by December 31. Most of the coverage has been about megawatts, and fair enough. These facilities can swing their demand faster than the grid is used to.
I read it a little differently. Once a facility matters enough to the grid that a regulator wants to know who’s running it, the very next question is who else can touch it.
Reliability Doesn’t Stop at the Fence Line
Nobody runs a modern data center alone. Employees, contractors, OEMs, managed service providers, and facilities teams all have a hand on the controls, and plenty of them are doing it remotely. The cyber-physical systems that keep the building alive, like building management, power monitoring, cooling, and UPS and generator controls, are exactly the systems those folks need to reach.
So, when something goes sideways, “what failed?” is only the first question. Right behind it comes who was connected, what they did, and whether a remote session had anything to do with it. If the honest answer is “we’d have to ask the vendor,” you’ve got a problem no amount of redundant power is going to fix.
Secure Remote Access Used to Be a Plumbing Problem
For most of its life, remote access was about connectivity. Can the vendor get in? Great, ticket closed. Nobody asked much beyond that, and honestly, nobody had to.
That’s changed. The question now is accountability, and it’s a much harder one. If I’m sitting in an executive or audit seat, here’s what I want answered without a three-week scavenger hunt:
- Who can reach our operational systems right now? Not who’s supposed to. Who can.
- Which third parties still have a standing way in?
- What can they touch once they’re connected?
- How does access get approved, watched, and shut off?
- When a session ends, can we replay what actually happened?
None of that is security-team trivia. It belongs in the same conversation as “how long can we run on generator?” Most operators can answer the generator question to the minute. Far fewer can answer the remote access questions at all.
We’ve Seen This Movie Before
Colonial Pipeline wasn’t taken down by some exotic zero-day. The way in was a single password for a VPN account nobody was using anymore, with no MFA in front of it. The pipeline was shut down for days anyway.
The electric sector learned this lesson the hard way, which is why NERC CIP has had specific requirements for interactive remote access for the better part of a decade, including being able to see active vendor sessions and cut them off. Nobody knows yet what the new computational load standards will look like, and I’m not going to pretend otherwise. But if you want a preview of how a reliability regulator thinks about remote access, the utilities have been living with the answer for years.
What Good Actually Looks Like
This is why purpose-built secure remote access (SRA) is getting so much more attention across critical infrastructure. A VPN gets someone connected. That’s all it was ever designed to do, and it does it fine. What it doesn’t do is tell you who that someone is, doesn’t hold them to a specific task, or let you watch what they’re doing.
For a data center operator, good looks like this: you can say who connected, when, to what, and what they did — and you could have ended the session the moment something looked wrong. That’s the bar. A VPN and a shared vendor login don’t clear it, and they were never built to.
Where Forescout Fits
Yes, this is the part where I talk about what we sell. I’ll keep it short. Forescout Secure Remote Access was built for exactly this problem:
- Identity-based access: Access is tied to a named person, role, asset, protocol, and time window. No more “vendor_admin” account shared by five people at three companies.
- Third-party governance: Vendors come in through an approval workflow, not a permanent tunnel somebody opened in 2021 and forgot about.
- Session visibility: Remote sessions are monitored, recorded, and logged, so an investigation starts with evidence instead of guesswork.
- Real-time control: Watch a live session and end it on the spot if something looks off.
- Reduced exposure: People reach the specific systems their task requires, not the whole operational network.
What Happens Next
NERC still has to write the standards and the registration criteria, and those will decide which facilities are on the hook and for what. FERC hasn’t told anyone to buy a particular remote access product, and I’d be suspicious of any vendor who tells you otherwise. Including me.
But you don’t need a final rule to see where this is headed. Data center reliability now includes operational control whether or not the paperwork has caught up. The operators who already know who’s connected to their critical systems, treat third-party access like it matters, and can pull the plug on a sketchy session are going to have a much easier 2027 than the ones starting from scratch.
A Question Worth Asking
If something broke tomorrow, could you answer this with a straight face?
Who had remote access to your critical systems, what did they do, and what evidence backs that up?
If the honest answer involves a lot of emails to vendors, it’s worth taking a harder look at how remote access is governed in your environment.
A Forescout Secure Remote Access Readiness Assessment is a good place to start. It finds the vendor pathways nobody’s managing, the access that’s broader than it needs to be, the visibility gaps, and the spots where today’s process won’t hold up to what’s coming.
Go deeper:
Secure Remote Access: the Door You Built Yourself
OT Security Analysis: Exposed Devices Attacked in US Water Systems
RDP Security: CPS Threats Spark Need for Secure Remote Access
Secure Remote Access: The Most Overlooked Exposure in Industrial Networks