Security Hardening
The following best practices help you strengthen the security posture of your SEW OrchestrationSuite tenant. How your tenant is configured, who has access and how accounts are protected is your responsibility.
Multi-Factor Authentication (MFA) is the most effective protection against account takeover. If MFA is disabled, a stolen, guessed or phished password alone is enough to access your tenant, including your PLC programs, project data and, through IDEaaS, connected OT environments. Disabling MFA may also conflict with your own regulatory obligations, for example under the NIS2 Directive.
Enable MFA Enforcement
Enable MFA Enforcement in Manage Company to require all users to set up Multi-Factor Authentication before accessing the platform. This ensures that compromised passwords alone cannot grant access to your tenant.
MFA Enforcement is not enabled by default for new tenants, so turn it on as one of the first steps after your tenant is set up and keep it enabled at all times.
If MFA Enforcement is turned off, other users who can manage company settings are notified by email and in the platform, and the change is recorded in the Audit Logs. If you receive this notification and did not expect it, check the audit log to see who made the change and turn MFA Enforcement back on.
Enable MFA for IDEaaS
For environments where IDEaaS provides access to sensitive OT infrastructure, enable MFA for IDEaaS in Manage Company. This requires users to verify their identity via a one-time code (email or authenticator app) before every IDEaaS session, adding a dedicated security layer for Browser Based Engineering access — even if platform-wide MFA is already enforced.
Configure User Role Expiration
Set a Maximum User Role Expiration to ensure that user permissions are regularly reviewed and renewed. This limits the window of exposure from stale or forgotten role assignments, particularly for external collaborators or temporary team members.
Monitor Security Changes
Review the Audit Logs regularly. Changes to your tenant's security settings are recorded with the category Security; use the Category filter to list them.