safe-remote-access-architecturelisted

## When to Use - Designing remote access for a new vendor, integrator, or remote operations center. - Redesigning remote access after an audit finding or an incident. - Replacing direct vendor tunnels or always-on accounts. - Adding a new remote access path to an existing OT network. ## Prerequisites - Zone and conduit design from `ot-network-segmentation-design` or the current zone map. - List of remote access roles: vendor engineers, control engineers, integrators, remote operations staff. - Access frequency and origin per role: how often, from which networks, to which systems. - DMZ capacity plan from `dmz-architecture-for-ot` if the DMZ exists. - SIEM or log platform capacity for session recording storage. - Credentials: none. This skill produces documents. - Authorization: security manager and operations manager review the completed design. - Upstream skills: `ot-network-segmentation-design` for the zone map. `dmz-architecture-for-ot` for the termination point. ### Safety This skill is passive. It produces design documents only. ## Workflow 1. Complete `references/questionnaire.md` with the access requester and the zone owners. Every access path in the final design must trace to a questionnaire answer. 2. Termination point decision. Requirement: no remote session reaches L1, L2, or L3 directly. Anchor: IEC 62443-3-3 SR 5.1. Decision: all remote sessions terminate on jump hosts in the L3.5 DMZ and are brokered from there. Trade-off accepted: an extra hop adds laten