CISA 2026-09-23

Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

Machine-generated analysis · WAYSCloud LLM

The fact sheet advises applying the principle of least privilege to third-party ICS integrators.

Context

The advisory addresses industrial control system (ICS) environments, including SCADA systems and programmable logic controllers. It recommends that critical infrastructure operators limit the access granted to third-party integrators by applying the principle of least privilege. The agencies note that lacking such controls could give malicious actors pathways to disrupt equipment and critical functions.

Operator considerations

Check: inventory all third-party integrator accounts and access permissions.
Isolate: segment integrator connections from core control networks where feasible.
Log: monitor and retain logs of integrator activity for review.

From Cybersecurity and Infrastructure Security Agency ↗

Introduction

The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—hereafter referred to as the “authoring agencies”—have published this fact sheet to highlight considerations for critical infrastructure entities to reduce risk and minimize vulnerabilities when working with third-party industrial control system (ICS) integrators.

ICS is an umbrella term referring to integrated networks of hardware and software designed to monitor and automate physical processes, encompassing specialized control systems and devices, such as supervisory control and data acquisition (SCADA) systems and programmable logic controllers. Third-party integrators provide varying types of services for ICS, such as control system design, installation, operational data analysis, device support and service, and daily operational control.

Critical infrastructure ow...

Read the full advisory on CISA →