An outside service relationship can become an inside risk
CISA and the FBI published guidance September 23 on working with third-party industrial control system integrators. The agencies urge operators to assess the access, data and operational authority entrusted to those providers. The fact sheet describes a 2025 intrusion at a U.S. industrial automation company in which attackers collected customer-related industrial information for presumed exfiltration. It does not establish that every downstream customer experienced disruption.
Consider more than the remote connection
The guidance addresses the information integrators hold as well as the control they receive. Network diagrams, device details and operational knowledge can matter alongside an active support account. Our analysis is that a supplier review should pair procurement records with an operational walk-through. A contract may name the service being purchased without making clear which engineering files are copied, where they are stored or who retains access after a project ends.
Adapt the review to the physical process
For a manufacturer, the review should identify the equipment and production process supported by each integrator. An energy or utility operator should establish who can approve a change and how emergency support access is controlled. A transportation organization should include the people responsible for continuity of the service, not only the corporate IT team. These are planning recommendations rather than evidence that a particular operator has weak controls. Any technical change must account for safety, availability and the organization’s authorized operating procedures.
Give each relationship an accountable owner
We recommend creating a concise record for each integrator: business owner, operational sponsor, approved access, data held, emergency contact and offboarding steps. Then choose one completed project and verify whether the recorded access still matches the current need. Where documentation is incomplete, resolve the gap with the supplier before making disruptive changes. The objective is a support relationship the operator can explain and supervise, including when work is urgent. Outsourcing specialist work should not leave the owner unable to identify who can affect the process.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
