Critical infrastructure owners and operators can reduce their exposure to cyber risk by applying the principle of least privilege, vetting integrator access, and building the ability to operate independently when working with third-party industrial control system (ICS) integrators, according to a joint fact sheet from the FBI and CISA published on September 29, 2026.<\/p>\n
Industrial control systems are integrated networks of hardware and software designed to monitor and automate physical processes. They include supervisory control and data acquisition (SCADA) systems and programmable logic controllers. Third-party ICS integrators provide services such as control system design, installation, operational data analysis, device and service support, and daily operational control.<\/p>\n
Granting outside firms extensive access to industrial processes can expose operators to malicious actors, who may use it to disrupt equipment.<\/p>\n
The principle of least privilege (PoLP) is designed to counter that risk. In operational technology (OT) environments, PoLP grants users, processes, and systems only the minimum access necessary to perform their assigned tasks.<\/p>\n
Between March and April 2025, malicious foreign cyber actors gained access to the network of a U.S. industrial automation solutions company that provided services, including system integration, engineering consulting, and SCADA programming, for industrial customers such as power utilities and transportation entities. While inside the network, the actors searched for terms including “customers” and “SCADA,” and assembled nine .zip files containing approximately 800 files for presumed exfiltration. The files included customer SCADA information, ICS device details, and other schematics.<\/p>\n
Exfiltrated data could later disrupt operations and interrupt services.<\/p>\n
The guidance lists questions for critical infrastructure organizations to consider before letting a third-party integrator into their networks and operations.<\/p>\n
The agencies recommend specific controls that owners and operators can include in service agreements and daily operations.<\/p>\n
Operators are urged to report suspicious cyber activity to a local FBI field office, the Internet Crime Complaint Center (IC3), or CISA’s 24\/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). Reports of suspected criminal activity can also go to 1-800-CALL-FBI (1-800-225-5324).<\/p>\n
Additional cited resources include CISA’s Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, CISA’s 2026 Minimum Elements for a Software Bill of Materials (SBOM), the Communications Sector Coordinating Council and IT Sector Coordinating Council’s Supplier, Products, and Services Threat Evaluation, and NIST’s Cybersecurity Supply Chain Risk Management guidance. For ICS cybersecurity advisories, the agencies point to CISA’s Industrial Control Systems pages.<\/p>\n
It recommends applying the principle of least privilege, vetting what data and remote access integrators receive, including cybersecurity and supply chain requirements in contracts, monitoring remote sessions, inventorying supplied hardware and software, and maintaining the ability to operate manually if an integrator is compromised.<\/p>\n
Between March and April 2025, foreign cyber actors compromised a U.S. industrial automation solutions company that provided system integration, engineering consulting, and SCADA programming services to power utilities and transportation entities. The actors searched for terms such as “customers” and “SCADA” and assembled roughly 800 files across nine .zip archives, including customer SCADA information, ICS device details, and schematics, for exfiltration.<\/p>\n
Reports can be made to a local FBI field office, the Internet Crime Complaint Center, or CISA’s 24\/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). Suspected criminal activity can also be reported at 1-800-CALL-FBI (1-800-225-5324).<\/p>\n