Define the access an integrator needs

A fact sheet from the Cybersecurity and Infrastructure Security Agency, CISA, and the Federal Bureau of Investigation, FBI, describes industrial control systems as hardware and software networks that monitor and automate physical processes. The agencies explain that outside integrators can design and install these systems, analyze operational data, support devices or manage daily operations. The access involved therefore depends on the services provided.

The agencies recommend applying the principle of least privilege: give each user, process or system only the permissions needed for its assigned work. In an operational technology environment, this means tying access to a specific task. They warn that failing to apply such principles could leave pathways that malicious actors might exploit to damage equipment or interrupt critical functions.

Assess data access and remote connections

CISA and FBI recommend routine assessments of contracts that provide access to industrial systems, including effects on control over organizational data and physical processes. Their assessment questions cover what information an integrator can reach and where it is stored. Network layouts, equipment specifications and logs can be useful to attackers, the agencies say. Data held abroad may also fall under that country's laws.

Remote support creates another access route to examine. The agencies describe a potential sequence in which an attacker compromises an integrator's network and then enters a utility's network to control systems. They recommend logging and monitoring remote access through observable connection routes. Where possible, they also recommend access that operators must actively enable on demand, alongside reducing devices' exposure to the public internet.

Set contractual requirements and prepare recovery

The agencies recommend putting cybersecurity and supply chain security requirements into contracts and service agreements. Their suggested subjects include storage locations, protection of system documentation, remote access, authorized personnel, and policies for changes and patches. Agreements should also address securing installed components, including replacing default passwords and turning off unused ports, plus arrangements for local engineering support that can limit dependence on integrator intervention.

Recovery planning asks whether operations can continue if the integrator is compromised. CISA and FBI recommend retaining redundancy and the ability to recover and operate independently, particularly for critical processes. They call for secure offline copies of software needed to run equipment. Operators should also request hardware and software inventories with connection and update documentation, and rehearse manual operation while accounting for third parties in recovery procedures.

Sources & context

  1. Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators | CISACISA

    Single-source report; claims attributed to the source, not independently verified. Source feed date (unspecified): 2026-09-23T12:00:00.000Z. Study date: not established. Consulted: 2026-09-30T17:00:03.176Z.

AI assisted with preparing and checking this article. The responsible editor accepted this version for publication following an assisted review of facts, sources and attribution.

Related reading