Critical infrastructure operators can reduce the cyber risk posed by third-party industrial control system integrators by limiting access, controlling remote connections, protecting operational data, and maintaining the ability to run critical processes without the integrator. A fact sheet from the Cybersecurity and Infrastructure Security Agency and FBI says operators should apply the principle of least privilege, granting users, systems, and processes only the access required for assigned tasks.
The central concern is not that every integrator is unsafe. Integrators perform legitimate work such as control-system design, installation, operational-data analysis, device support, SCADA programming, and daily operational control. The concern is that their access, equipment, networks, or data-handling practices can create pathways into operational technology environments. The agencies’ recommendations are intended to help operators determine which pathways exist, restrict them, and prepare for the possibility that an integrator’s network or account could be compromised.
Industrial control systems, or ICS, include connected hardware and software used to monitor and automate physical processes. The category covers systems such as supervisory control and data acquisition platforms and programmable logic controllers. Because these systems can influence physical equipment and critical functions, an integrator with broad access may possess information or permissions that would be valuable to a malicious cyber actor.
The agencies identify several ways that risk can arise. An integrator may introduce systems or services that were not configured to match the customer’s security requirements. Design and installation work can also create supply-chain exposure if the operator and integrator do not set clear requirements for procuring, handling, securing, and updating components. The fact sheet also flags data stored or hosted outside the United States as a consideration because foreign laws may govern that information, including in some cases when a foreign-owned integrator operates through a U.S. subsidiary.
A cited FBI technical analysis describes one example. Between March and April 2025, foreign malicious cyber actors accessed the network of a U.S. industrial automation solutions company that provided system integration, engineering consulting, and SCADA programming for industrial customers, including power utilities and transportation entities. While inside the company’s network, the actors searched for terms such as “customers” and “SCADA” and created nine ZIP files containing approximately 800 files for presumed exfiltration. The files reportedly included customer SCADA information, ICS device details, and other schematics. The agencies say such information could later help enable disruptive attacks against operational environments and critical services. The incident demonstrates the type of exposure the guidance addresses, but it does not establish that every third-party integrator presents the same level of risk or that the described information was used in a later attack.
The first practical question for an operator is what the integrator can reach. Risk assessments should examine contracts involving industrial-system access and consider effects on data autonomy and process controls. They should cover the hardware and software supplied by the integrator, the security of those devices and their associated networks, and vulnerabilities introduced through the IT and operational technology environments.
Operators should identify what organizational data an integrator stores or can access. Network designs, device specifications, logs, and other technical information may help an attacker understand an operational environment. The relevant issue is not only whether the integrator needs the information, but also whether the operator can prevent unnecessary access and determine how the data is protected.
The location of stored data is another unresolved question that each operator must answer for its own arrangement. If information is stored internationally, the agencies advise considering which country’s laws govern it and whether those rules meet the operator’s security and data-management requirements. The fact sheet does not declare that international storage is automatically insecure. It identifies jurisdiction and control over the data as factors in the risk assessment.
Remote access requires similar scrutiny. If an integrator can connect to an ICS network for support, a compromise of the integrator’s network could provide a route toward the operator’s systems. Operators should therefore understand how remote connections are secured, restrict them to necessary equipment and functions, and use access routes that can be monitored and logged. The agencies recommend on-demand remote access where possible, allowing operators to approve access proactively rather than leaving a persistent connection available.
Contracts and service agreements are a key control because they establish requirements before access or equipment is provided. The agencies recommend addressing data-storage locations, information-protection agreements, safeguards for ICS data and design documentation, remote-access capabilities, the integrator’s basic cybersecurity program, and change- and patch-management policies. Agreements should also address how deployed components are secured, including changing default passwords and disabling unused ports; identify authorized personnel; and provide for local engineering support when necessary so the operator can limit integrator intervention.
Operators should request a complete inventory of hardware and software supplied by the integrator, along with documentation showing how each component connects to the infrastructure and how it will be updated. Devices with external internet exposure should be evaluated with the integrator, and public-facing exposure should be minimized by disconnecting devices from the internet when that connection is not required.
Operational resilience is the final test: can the organization continue essential work if the integrator is unavailable or compromised? The agencies recommend redundancies, recovery capabilities, secure offline backups of software needed to operate equipment, and practiced procedures for manual operations. Those exercises should account for the third party’s role in both normal operations and recovery.
What is known is the set of access, supply-chain, data, remote-connection, and recovery risks identified by the agencies, along with the 2025 intrusion example. What remains organization-specific is whether a particular integrator stores sensitive information abroad, which personnel have access, whether devices are exposed to the internet, how remote sessions are controlled, and whether the operator can function independently. Those questions determine the safeguards needed for each industrial environment.