What CMMS Is and Why It Matters for Security
A Computerized Maintenance Management System (CMMS) is the software platform used by industrial operators to manage maintenance activities for physical assets — plant equipment, infrastructure components, OT devices, and facilities. The CMMS tracks equipment maintenance schedules, work orders, spare parts inventory, maintenance history, and compliance documentation. Major CMMS platforms include IBM Maximo, Infor EAM, SAP PM, AVEVA Asset Management, and Hexagon Asset Lifecycle Intelligence.
CMMS is not typically the first system that comes to mind in an OT security risk assessment — it does not control physical processes, does not communicate using industrial protocols, and does not directly interface with PLCs or field devices. But it is a significant security surface for two reasons that are specific to the OT context: it contains operational intelligence that is valuable to threat actors, and it is the system through which external vendors access physical OT assets for preventive maintenance and repair.
CMMS as Operational Intelligence
The maintenance schedules and asset data in a CMMS reveal operational patterns that a sophisticated adversary can exploit. Scheduled maintenance windows for critical equipment — turbine inspections, PLC firmware updates, pump overhauls — represent periods when the associated process is offline or operating in a degraded mode. An adversary with access to CMMS maintenance schedules knows when a safety system will be offline for testing, when a backup generator will be unavailable for servicing, and when a process control system will be in engineering access mode for configuration changes. This intelligence can be used to time a physical or cyber attack to maximize impact while minimizing the operator's defensive options.
Asset information in the CMMS — equipment models, firmware versions, maintenance history, known fault patterns — is also useful for attack planning. Knowing that a facility uses a specific model of PLC with a known vulnerability, combined with the maintenance schedule that shows when that PLC's network connection is accessible to the maintenance contractor, provides a detailed attack playbook.
Vendor Access Through CMMS
The CMMS is the system of record for planned maintenance activities, including activities performed by OEM vendors and specialist contractors. When a vendor is scheduled for preventive maintenance on a DCS, a CMMS work order governs the scope, timing, and approval of that access. In practice, many organizations have not implemented the link between CMMS work order approval and physical or logical access provisioning — the CMMS approves the work, but the actual network access to the OT system is managed separately (or not managed at all, relying on standing VPN credentials).
Zero Trust vendor access management for OT environments should be integrated with CMMS workflows. Vendor network access should be provisioned only when an approved CMMS work order is active, should be scoped to the specific OT systems referenced in the work order, and should be automatically revoked when the work order is closed. This integration closes a significant governance gap: it ensures that vendor access exists only when authorized work is in progress, and that the scope of access matches the scope of approved work.
How Zero Trust Controls Apply to CMMS
CMMS access control should implement least-privilege RBAC: maintenance technicians see work orders and asset data for their assigned equipment and work area; planners see scheduling and resource data; managers see reports and KPIs. Administrative access to CMMS configuration should require PAM with MFA and session logging. External vendor access to CMMS — for vendor-managed maintenance programs or remote monitoring services — should require authentication and should be limited to the data relevant to the vendor's contracted scope.
CMMS platforms that are cloud-hosted (a growing deployment model) require the same API security controls as other enterprise SaaS: MFA for all users, SSO integration with the enterprise identity provider, audit logging of all access, and DLP controls on exports of maintenance data that could constitute sensitive operational intelligence.
The integration between CMMS work order approval and OT system access provisioning — though technically achievable through PAM platform APIs — requires organizational process change as much as technical integration. Security teams should engage facilities and maintenance management to establish the process: no vendor physical or logical access to OT systems without an open, approved CMMS work order, and automatic access revocation on work order closure.
Regulatory Frameworks
CMMS is not directly regulated by sector-specific OT frameworks, but it is indirectly covered through supply chain security requirements. NERC-CIP CIP-013 supply chain risk management covers vendor relationships that include access to BES Cyber Systems — CMMS-managed maintenance vendors who access NERC-CIP covered assets fall within this scope. NIS2 supply chain security requirements similarly apply to maintenance vendor relationships for covered entities.
Market Context
The global CMMS market is valued at approximately $1.1 billion and growing at 9-10% annually, with cloud-based deployments becoming the dominant deployment model. The integration of CMMS with OT asset management platforms — IIoT connectivity to track equipment health in real-time rather than relying on scheduled maintenance intervals — is driving convergence between CMMS and OT security asset management that creates new security architecture considerations.