Critical infrastructure operators use third-party industrial control system integrators for tasks that can include system design, installation, operational data analysis, device support, service, and daily operational control. A fact sheet from CISA and the FBI urges owners and operators to apply least privilege, meaning that each user, process, or system receives only the access required for its assigned task.
The concern is that an integrator can become a pathway into operational technology, or OT, environments. ICS refers to connected hardware and software used to monitor and automate physical processes, including supervisory control and data acquisition systems and programmable logic controllers. An integrator can have access to those systems for installation, device support and service, or daily operational control. That access can also expose network designs, device specifications, logs, schematics, and other information that could help a malicious cyber actor understand or target an operator’s environment.
The fact sheet describes a specific incident as an example of how that risk can develop. Between March and April 2025, foreign malicious cyber actors gained access to the network of a U.S. industrial automation solutions company that provided system integration, engineering consulting, and SCADA programming for industrial customers, including power utilities and transportation entities. The actors searched for terms such as “customers” and “SCADA” and created nine ZIP files containing approximately 800 files for presumed exfiltration. The files reportedly included customer SCADA information, ICS device details, and other schematics. The agencies say such information could later be used to support disruptive attacks against operational environments and critical services.
The account describes the network intrusion, the searches, the creation of the archives, and the types and approximate volume of files involved. It describes presumed exfiltration and possible consequences, rather than documenting a subsequent disruption of a utility or transportation service.
Least privilege is one principle in the agencies’ guidance. It calls for granting users, processes, and systems only the minimum access necessary to perform assigned tasks. Remote access deserves particular scrutiny because a compromise of an integrator’s network could provide a route into the operator’s ICS network. The guidance calls for remote connections that the operator can monitor and log, and recommends on-demand access when possible, so personnel must proactively enable the connection.
The operator also needs to understand where the integrator stores information and who can reach it. Data may include network architecture, equipment specifications, logs, and design documents. The agencies advise asking whether information is stored in the United States or internationally, particularly when an integrator is foreign-owned. International storage may subject the data to the laws of the country where it is held, even when the integrator operates through a U.S. subsidiary. The guidance identifies this as a data-governance and security consideration.
Supply-chain exposure is another part of the problem. Integrators can install and support hardware and software that become part of an operator’s control environment. If the parties do not establish clear requirements for secure procurement and handling, the equipment and its supporting networks may introduce weaknesses that were not part of the customer’s original security design. Operators are advised to request an inventory of all hardware and software supplied by the integrator, along with documentation showing how each component connects to the infrastructure and how it will be updated.
The agencies recommend including cybersecurity and supply-chain cybersecurity requirements in contracts and service agreements. Relevant provisions can cover data-storage locations, information-protection agreements, remote-access capabilities, the integrator’s cybersecurity program, change-management and patch-management policies, and the steps used to secure deployed components. Examples include changing default passwords and disabling unused ports. Agreements can also identify authorized personnel, require processes for local engineering support, and limit required integrator intervention.
Operators should examine devices that are reachable from the public internet and work with integrators to reduce that exposure, including by disconnecting devices from public-facing networks when possible. Remote access should use routes that can be monitored. On-demand remote access can require operators to proactively allow a connection. These measures address potential paths from an integrator’s environment into an operational network.
Risk assessments should address more than the technical connection. The agencies recommend evaluating contracts involving industrial-system access for effects on data autonomy and process controls. Assessments should consider hardware and software supply-chain vulnerabilities, the IT and OT security of supplied devices and associated networks, and geopolitical factors when a foreign-owned integrator is under consideration. The questions include what data the integrator can store or access, where that data is stored, whether the integrator has remote access, and whether the organization can operate independently if the integrator is compromised.
Operational independence is a resilience issue. Operators are advised to maintain redundancies, secure offline backups of all software required to operate equipment, and the ability to recover the system and operate without the integrator, especially for operationally critical processes. They should also practice manual-operation procedures and account for the third party in recovery plans. The fact sheet says these capabilities can reduce risk if an integrator is compromised.
The guidance does not establish that every integrator creates the same level of danger, nor does it identify a single technical control as sufficient. Its concern is the risk created when third-party access, stored information, supplied components, and dependence on an integrator are not assessed and managed. The agencies’ recommendations focus on limiting access, monitoring connections, protecting information and components, and maintaining the ability to recover and operate critical processes without the third party.