Challenges of VPNs in Meeting NERC CIP-003-9 Compliance

This technical report discusses the limitations of Virtual Private Networks (VPNs) in fulfilling the new regulatory requirements set by NERC CIP-003-9, which takes effect on April 1, 2026. The report outlines how traditional VPNs, designed for basic connectivity, fail to provide the necessary visibility and control over remote access sessions to critical infrastructure. It details three specific compliance requirements that VPNs cannot meet: the ability to identify individual vendor sessions, disable access on demand, and detect malicious communications. The report further explains that the architecture of VPNs inherently lacks the capability to monitor session activities, which is now mandated by emerging regulations like TSA Security Directive SD-02F. Additionally, it highlights the structural failures of VPNs, including broad access scope and lack of session-level evidence, which complicate compliance efforts. The document emphasizes the need for a new architectural approach to remote access that ensures accountability and meets regulatory standards.