What the CISA and FBI Fact Sheet on Third-Party ICS Integrators Recommends

Summary

On September 23, 2026, the FBI and CISA published "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators". This short fact sheet covers the companies that design, install, support and sometimes operate a utility's control systems.

The fact sheet is based on least privilege: an integrator gets the minimum access needed for the assigned task.

The fact sheet does not describe integrators as untrustworthy. It describes them as a target. An integrator holds the drawings, device lists and remote access paths for many customers at once, so an attacker gains more by breaking into one integrator than by breaking into one customer.

The 2025 breach described in the fact sheet

The fact sheet gives one example. Between March and April 2025, attackers breached a U.S. industrial automation company that served power utilities and transportation entities. Inside its network, they searched for terms like "customers" and "SCADA". They then built nine .zip files containing about 800 files for exfiltration, including customer SCADA information and ICS device details.

The attackers did not attack a utility directly. The integrator's file server held the information they needed about the utilities.

The four questions CISA and the FBI ask

CISA and the FBI ask operators to assess each integrator relationship with four questions:

1. Which of your data does the integrator store or access? Designs, device specifications and logs are exactly what an attacker needs to plan an operation against you.
2. Where is the data stored? If it is stored abroad, that country's laws may govern it, even when the integrator is U.S.-based.
3. Does the integrator have remote access for operational support? If so, an attacker who compromises the integrator's network could use it to reach your systems.
4. Can you keep operating if the integrator is compromised? Redundancy and offline backups of operational software reduce the risk.

The first two questions concern data you have already given to the integrator. The third concerns the remote access you have given. The fourth asks whether you can remove that access and keep running.

What the fact sheet recommends

Write security into the contract. The fact sheet lists what the contract should cover:

• where data is stored and how ICS data and design documentation are protected
• remote access capabilities
• the basics of the integrator's cybersecurity program
• change management and patch management
• securing deployed components, such as changing default passwords and disabling unused ports
• a list of authorised personnel with system access
• processes that let local engineers support the system, to limit reliance on the integrator

Take these operational steps:

• find devices exposed to the internet and work with the integrator to take them off public-facing networks
• have integrators reach equipment only through routes you can monitor, log all remote access, and use on-demand access where possible
• get an inventory of everything the integrator supplied, hardware and software, with how it connects and how it will be updated
• practise manual operations, and plan recovery with the integrator's role in mind

How to control integrator remote access

Most of the fact sheet covers contracts and documentation, and these matter. One recommendation also decides whether an incident like the 2025 breach stays a data leak or affects operations: how the integrator connects to your systems.

Integrators usually connect with a standing VPN account, sometimes a shared one. Sometimes they use a cellular router they installed during commissioning and never removed. Compare that setup with the fact sheet's wording:

• "Routes the organization is able to monitor." A VPN tunnel shows you encrypted traffic from an address. It does not show which person is connected, which asset they used, or what they did to it.
• "On-demand access." A VPN account that works at 3 a.m. on a Sunday is always available. It is not on-demand access.
• "Authorized personnel lists." With a shared integrator login, you cannot tell which person on the list connected.
• Least privilege. A VPN puts the integrator's laptop on a network. Least privilege gives the integrator's engineer access to the three controllers in the work order and nothing else.

Keep the VPN or cellular link for the connection, and add a gate that meets all four points. The gate gives a session to each named person, to the specific assets the task needs. The session opens for the task, is recorded, and closes when the work ends. The integrator's engineers can sign in against a directory separate from your staff directory, such as a second Active Directory or the directory built into the gate, with MFA at the gate. Nothing on the integrator's network then has standing access to your systems.

Why small utilities are most exposed

A large utility has an OT team that can review an integrator's work. A small water system often relies on the integrator instead of an OT team. The integrator built the SCADA system, holds the only up-to-date drawings, and is the first call when something breaks.

The fact sheet's fourth question matters most for small utilities. Suppose the integrator is compromised tomorrow and you cut their access. Ask whether your operators can run the plant by hand, and whether someone local can restore the HMI from a backup. If the answer is no, fix that first, before you change any contract clause. Answer this question before an incident forces it.

Six steps to take this month

1. List every integrator and vendor with access. Record the company, the named people, what they can reach, how they connect, and when they last connected.
2. Remove standing access. Remove shared accounts and always-on VPN profiles, and find the cellular routers nobody remembers installing. Route each remaining connection through a gate that opens access per task and records it.
3. Ask for the inventory of everything the integrator supplied, with how it connects and how it is updated.
4. Find out where your data is stored. Identify which integrator systems hold your drawings, device lists and configuration backups, and in which country.
5. Run a manual-operations drill. Assume the integrator is unavailable for a week, and find out what stops working.
6. Add these points to the next contract. Use the fact sheet's list as the starting checklist at renewal.