# FBI and CISA Urge Least Privilege for Third-Party ICS Integrators _The FBI and CISA published a fact sheet on September 23, 2026, on the access third-party integrators hold to industrial control systems. It asks operators to apply least privilege, list authorized integrator staff in contracts and keep remote access off, where possible, until they allow it._ By Johannes Keienburg, CEO & Founder Published: 2026-09-29 Source: https://www.cakewalk.security/blog/fbi-cisa-third-party-integrator-access --- ## An Integrator's Access Is Only as Safe as the Integrator's Network Critical infrastructure operators can hire third-party integrators to design, install and even run their industrial control systems (ICS), the networks of hardware and software that automate physical processes. On September 23, 2026, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) published a fact sheet on the access those integrators hold. It asks operators to apply [least privilege](/glossary/least-privilege) to integrators and to name in their contracts the integrator staff authorized to access their systems. It also asks them to keep remote access off, where possible, until an operator allows it. Its concern is that an operator who grants an integrator access also takes on the security of the integrator's own network. > If the integrator has remote access to the organization's ICS network, then there is a potential risk that a malicious cyber actor could gain access to the integrator's network and pivot into the utility's network to gain control of their systems. _FBI and CISA fact sheet_ The fact sheet cites a case from FBI technical analysis. Foreign actors got into the network of a U.S. industrial automation company between March and April 2025. The company provided services such as system integration, engineering consulting and programming for supervisory control and data acquisition (SCADA) systems, for customers including power utilities and transportation entities. On its network the actors searched for terms such as "customers" and "SCADA." They packed about 800 files, including customer SCADA information and device details, into nine archives for presumed [exfiltration](/glossary/data-exfiltration). The fact sheet does not say whether the actors entered any customer network afterward. ## Integrator Access Starts in the Contract and Runs Through Monitored Routes The agencies want the terms written down before anyone connects. Contracts should cover remote access capabilities. Operators should monitor and log remote access. The fact sheet does not cover [reviewing](/glossary/access-review) which integrator staff still hold access or removing it when an engagement ends. [Access reviews](/blog/user-access-review-tools) exist to answer the first of those questions. > Ensure integrators access equipment using routes you are able to monitor. Use on-demand remote access if possible, so operators have to proactively allow remote access. _FBI and CISA fact sheet_ > A contract listing authorized integrator staff goes stale when the integrator's team changes. Contractor access should follow the same path as employee access: a request, approval from a named person, only the access the engagement needs and removal when the work ends. One record of those decisions tells an investigator which contractor held which access and who approved it. _Comment from Gil Röder, CPO & Co-Founder_ Source: FBI and CISA, [Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators](https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators), September 23, 2026.