Knowing that, critical infrastructure owners and operators, according to the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), should maintain caution when granting third-party ICS integrators high levels of access or control over industrial processes.
To help in that regard, the agencies released a fact sheet entitled, “Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators,” to help critical infrastructure organizations work with their third-party industrial control systems (ICS) integrators to establish secure practices and frameworks.
Using third-party ICS integrators in critical infrastructure may inadvertently introduce security issues to an environment by exposing systems and services not pre-configured to the user’s security requirements.
Critical infrastructure owners and operators that rely on third-party integrators for system design face supply chain risks if integrators and owners and operators do not collectively enforce clear requirements for the secure procurement and handling of system components.
Additional Risk
Furthermore, third-party integrators that operate and host data outside the United States may pose additional risks, as they may be subject to different data storage and management laws that do not meet the security needs of U.S. critical infrastructure entities.
Between March and April 2025, malicious foreign cyber actors gained access to the network of a U.S. industrial automation solutions company that offered services – such as system integration, engineering consulting, and SCADA programming – for industrial customers, including power utilities and transportation entities, according to FBI technical analysis.
While on the network, threat actors searched terms, including “customers” and “SCADA,” and created nine .zip files consisting of approximately 800 files for presumed exfiltration, including customer SCADA information, ICS device details, and other schematics.
Malicious cyber actors could leverage the exfiltrated information to later conduct disruptive attacks against operational environments and disrupt critical services.
Critical infrastructure owners and operators should make risk-informed decisions when considering introducing third-party integrators into their networks and operations, guided by a robust understanding of the organizational risks posed by providing sensitive access to their systems, according to the advisory.
Recommendations
The following are recommendations for critical infrastructure owners and operators to implement to reduce the risks associated with using third-party ICS integrators:
- Prepare contracts and service agreements that include cybersecurity and supply chain cybersecurity with requirements on key areas like data storage, remote access, patch policies, authorized personnel lists, and engineering controls to limit integrator lock-in.
- Evaluate devices with external Internet exposure and work with integrators to understand and minimize exposure by disconnecting devices from public-facing Internet.
- Ensure integrators access equipment through routes the organization is able to monitor.
- Request an inventory of all software and hardware supplied by the integrator, including documentation describing how it connects to infrastructure and how it will be updated.
- Practice procedures and maintain capabilities for manual operations, keeping in mind, and accounting for, where third parties fit into the environment and recovery procedures.
Click here to view more on “Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators.”