The regulations are not as locked down as you would expect. Think less:

* Remote access to systems that could kill people must be limited to people with the following thought out permissions and secured credentials

And more:

* The list of people who can access this system must be documented

* The accounts must have their password be changed every 6 months

* A committee must review the set of outstanding patches and upgrades for known issues every 4 months and prioritize what to fix

* I hope that someone is actually installing those patches and upgrades.