Cloud managed encryption gateway critical infrastructure risk

A cloud managed encryption gateway is a network encryption device whose configuration, keys, licences or updates are controlled through an internet portal run by the vendor, not from systems the operator owns. For OT and critical infrastructure operators, the risk is that the availability, confidentiality and change control of protected links start to depend on a third party.

This trade-off is now more pressing because many operators are replacing classical VPNs with quantum-safe tunnels. The EU timeline says all Member States should start transitioning to PQC by the end of 2026, and the protection of high-risk use cases should be transitioned to PQC as soon as possible, no later than by the end of 2030. Operators who choose new gateways for that migration are also choosing a management model, and that model stays with them for the life of the equipment.

Is it safe to manage OT encryption gateways from a vendor cloud portal?

It can be acceptable for low-criticality links, but for OT and critical infrastructure a cloud portal makes the vendor part of your trust boundary. Whoever controls the portal can in principle change routes, push firmware or disable tunnels on every connected site at once.

The core issue is privilege concentration. In a typical cloud-managed design the gateway keeps an outbound session open to the vendor, and the portal pushes policy back down that session. That channel is a standing, vendor-operated path into the device that sits between your control centre and your substations, pumping stations or plants. The NIST draft of SP 800-82r4 says so directly: “Cellular modems and vendor-managed connections can bypass enterprise and OT network security controls.” NIST also advises that organizations should inventory and approve these connections, restrict what they can reach, monitor their use where possible, and prevent them from creating unmanaged paths into OT networks.

Three questions decide whether a cloud portal is tolerable for a given link:

• Blast radius: can one portal account, or one compromise of the vendor’s tenant, change the configuration of every gateway you own?
• Direction of control: does the gateway pull approved changes, or can the portal push them without a local approval step?
• Independence: does the data plane keep running, unchanged, when the portal cannot be reached?

Joint guidance from CISA and partner agencies, including BSI and NCSC-NL, gives a procurement rule for this situation: if two-way connections are required, buyers should seek out products that require an operator’s approval to establish a connection. Exposure is also measurable. In ENISA’s 2025 analysis, operational technology threats represent 18.2% of recorded threat categories.

Which configuration, key and metadata leave the site when a gateway phones home?

Depending on the product, a phoning-home gateway may send a large part of your network design: addressing, peers, routing, firmware state and traffic patterns. If configuration backups are stored in the vendor cloud, key material can leave too. Ask each vendor for a field-by-field list, then confirm it with a packet capture.

Vendors rarely publish complete telemetry schemas, so the table below lists the categories to ask about and why each one matters in an OT context.

The key question matters more for quantum-safe links than it appears. If a vendor-held backup contains long-term private keys, an adversary who records traffic today and later obtains that backup may not need a quantum computer at all. A hybrid post-quantum handshake only delivers its value if key material never leaves the endpoints.

Do quantum-safe tunnels keep working if the cloud management service or licence server goes offline?

That depends entirely on the product, and you have to test it rather than assume it. Some gateways keep running tunnels on cached configuration. Others block changes, refuse to re-establish tunnels after a reboot, or disable features once a licence check fails.

OT links need to survive scenarios that are rare in office IT: a substation rebooting after a power cut during an internet outage, an island site whose WAN link is down for days, or a vendor that stops trading. Work through each scenario with the vendor before purchase.

As an illustration of the kind of behaviour to look for, Quantum Network’s QPN gateway sends no telemetry and has no cloud dependency. Without an active subscription it keeps working in its current state, but it no longer receives support or security updates. Its connection never falls back to unencrypted traffic and retries automatically after a line failure. Whichever product you evaluate, ask for the same statements in writing and check them against the tests above.

How does NIS2 supply chain security apply to cloud-managed network encryption?

Under NIS2 Directive Article 21, a vendor that operates the management cloud for your encryption gateways is a direct supplier or service provider. Its security practices therefore fall within your own risk management obligations, not just the vendor’s.

NIS2 Directive Article 21(2) lists the minimum measures, including supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers. Article 21(3) adds that entities must take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. For a cloud-managed gateway, that means assessing both the hardware and the vendor’s portal, identity system and update pipeline.

Commission Implementing Regulation (EU) 2024/2690 formally applies to specific categories of digital entities, but its supply chain section is a useful contract template for any operator. It lists clauses such as an obligation on suppliers and service providers to notify, without undue delay, the relevant entities of incidents, along with audit rights and vulnerability handling.

Operators report that this is hard in practice:

• Over a third of entities surveyed (37%) identified supply-chain risk management as the most difficult NIS2 requirement to implement (ENISA NIS Investments 2025).
• Supply chain attacks are the second most frequently cited top concern, with almost one in two (47%) entities naming them (ENISA NIS Investments 2025).
• Infrastructure constraints, typically the persistence of legacy systems or limitations posed by operational technologies (27%), were the most cited obstacle to implementing NIS2 (ENISA NIS Investments 2025).
• Vulnerability exploitation (21.3%) is the second leading intrusion vector in the EU (ENISA Threat Landscape 2025), which is why the vendor’s patching and disclosure process deserves scrutiny.

Related instruments: CRA, IEC 62443-2-4 and the EU Data Act

The Cyber Resilience Act (EU) 2024/2847 puts obligations on manufacturers. The main obligations introduced by the Act will apply from 11 December 2027, with reporting obligations to apply as of 11 September 2026. The Commission’s 2026 guidance specifically addresses when remote data processing solutions fall within scope, and how support periods should be understood. Both points are relevant when the management cloud is part of how the product functions.

IEC 62443-2-4 sets security programme requirements for service providers that integrate and maintain industrial automation and control systems. Operators can use it to define what an integrator or maintenance partner with portal access must demonstrate. The EU Data Act (Regulation (EU) 2023/2854) is relevant where gateway telemetry counts as data generated by a connected product, and it also contains rules on switching between data processing services. Check with legal counsel whether and how it applies to your contracts.

What should critical infrastructure operators require for a fully on-premises management plane?

Require that every management function (configuration, key lifecycle, monitoring, licensing and updates) can run on systems you own, including at air-gapped sites. Also require that no vendor connectivity is needed for the tunnels to start, run or recover.

A practical requirement set for tenders:

1. Local management with no cloud account: full configuration through an on-premises interface, with role-based access and your own identity provider.
2. Keys generated and kept on the device: private keys are non-exportable, session keys never leave the endpoints, and backups contain no secrets in the clear.
3. Offline licensing: no periodic check-in. If a subscription lapses, the operating state stays the same.
4. Offline update path: signed firmware and algorithm packages that can be verified and installed from removable media or an internal repository. This matters because the EU roadmap treats crypto agility as fundamental. It notes that cryptographic routines and ciphers can be easily upgraded or replaced without having to completely replace the underlying application or device.
5. Telemetry off by default: any logging goes to your own collector, documented field by field.
6. Push, not pull: the guidance that buyers should seek out manufacturers that rely on data pushed out of the OT network as necessary, rather than pulling data out applies equally to management traffic.
7. Exit terms: written confirmation of behaviour if the vendor discontinues its service, including how configurations and keys stay usable.

The joint CISA-led guidance on OT procurement sums up the test in one line: “Ask if vendors can operate on premises or without continuous access to the internet/vendor cloud.”

Aligning management choices with the post-quantum timeline

The Commission’s 2024 Recommendation foresees PQC deployment in critical infrastructures via hybrid schemes that may combine Post-Quantum Cryptography with existing cryptographic approaches. Commission Executive Vice-President Henna Virkkunen described the roadmap this way: “The post-quantum cryptography roadmap provides a clear direction to ensure the robust security of our digital infrastructure.” Gateways bought now will probably still be in service when the 2030 milestone for critical infrastructure arrives. If you choose a management model that also works without the vendor’s cloud, algorithm changes over that period will not depend on a third party’s uptime.