FBI and CISA Urge Least Privilege for Third-Party ICS Integrators

1An Integrator's Access Is Only as Safe as the Integrator's Network

Critical infrastructure operators can hire third-party integrators to design, install and even run their industrial control systems (ICS), the networks of hardware and software that automate physical processes. On September 23, 2026, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) published a fact sheet on the access those integrators hold. It asks operators to apply least privilegeGlossaryLeast PrivilegeThe principle of least privilege requires that every identity (human or machine) operates with only the minimum permissions necessary to complete its… to integrators and to name in their contracts the integrator staff authorized to access their systems. It also asks them to keep remote access off, where possible, until an operator allows it. Its concern is that an operator who grants an integrator access also takes on the security of the integrator's own network.

If the integrator has remote access to the organization's ICS network, then there is a potential risk that a malicious cyber actor could gain access to the integrator's network and pivot into the utility's network to gain control of their systems.

FBI and CISA fact sheet

The fact sheet cites a case from FBI technical analysis. Foreign actors got into the network of a U.S. industrial automation company between March and April 2025. The company provided services such as system integration, engineering consulting and programming for supervisory control and data acquisition (SCADA) systems, for customers including power utilities and transportation entities. On its network the actors searched for terms such as "customers" and "SCADA." They packed about 800 files, including customer SCADA information and device details, into nine archives for presumed exfiltrationGlossaryData ExfiltrationData exfiltration is the unauthorized transfer of data from an organization's systems to an external location. In AI agent contexts, exfiltration…. The fact sheet does not say whether the actors entered any customer network afterward.

2Integrator Access Starts in the Contract and Runs Through Monitored Routes

The agencies want the terms written down before anyone connects. Contracts should cover remote access capabilities. Operators should monitor and log remote access. The fact sheet does not cover reviewingGlossaryAccess ReviewAn access review is a systematic process of validating that existing access permissions are still appropriate for each user. Reviewers (typically… which integrator staff still hold access or removing it when an engagement ends. Access reviewsField GuideTop 5 User Access Review Tools in 2026The five user access review tools worth evaluating in 2026, judged on what actually reduces risk: reviews that execute the revoke, show context… exist to answer the first of those questions.

Ensure integrators access equipment using routes you are able to monitor. Use on-demand remote access if possible, so operators have to proactively allow remote access.

FBI and CISA fact sheet

Source: FBI and CISA, Considerations for Critical Infrastructure Operators Working With Third-Party ICS IntegratorsExternal Link Tohttps://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators, September 23, 2026.