What this is about
On September 23, 2026, the FBI and CISA jointly published a fact sheet aimed at critical infrastructure operators, addressing the security risks of working with third-party ICS integrators. These are the service providers that plan, install, configure, and maintain industrial control systems, meaning the SCADA systems, programmable logic controllers (PLCs), and networked hardware and software that monitor and automate physical processes in power plants, water utilities, production facilities, and transport operations.
The heart of the problem is that critical infrastructure operators often lack the specialised knowledge to build and run their OT environment on their own, and therefore rely on external integrators. In doing so, these integrators gain deep and privileged access to the operator’s most sensitive systems, frequently combined with persistent remote access and with sensitive facility data stored on the integrator’s own systems. It is precisely this constellation that turns the integrator into an attractive target and a potential point of entry.
The risk: privileged access and sensitive data
From an attacker’s perspective, a compromised integrator is a master key. Whoever takes over the service provider potentially gains access to the OT environments of several operators at once, including the remote access routes the integrator normally uses for maintenance. On top of this, integrators often store detailed documentation about their customers’ facilities, from network diagrams and device configurations to complete schematics.
The fact sheet points to a concrete incident: between March and April 2025, attackers compromised a US industrial automation company and assembled nine ZIP files containing around 800 files, including customer SCADA information, ICS device details, and further schematics, apparently for exfiltration and later attacks. Such documentation is valuable to an attacker because it shortens the laborious reconnaissance phase and makes a targeted attack on the physical processes possible in the first place.
Four questions every operator should answer
CISA and the FBI recommend evaluating every relationship with an integrator against four fundamental questions:
What data does the integrator access or store? The more documentation about your own facility resides with a third party, the greater the damage if that third party is compromised.
Where is this data physically stored? The question of storage location (domestic or abroad) touches both on data sovereignty and on the question of which legal framework the data is subject to.
Does the integrator maintain persistent remote access? An always-on connection is convenient, but it is also a permanent attack path that can be abused independently of the operator.
Can operations continue without the integrator? An operator that becomes unable to act when its service provider is compromised has a resilience problem that goes beyond pure IT security.
The recommendations at a glance
The fact sheet groups its recommendations into several areas that together produce a robust level of security.
Contractual requirements: Contracts with integrators should contain concrete specifications, among them the storage location of the data, the remote access protocols, the security standards to be met, patch management, the changing of default passwords, and a list of authorised personnel. Security must be governed by contract and cannot be left to chance.
Access control on the least-privilege principle: An integrator should receive only the minimum access needed for its specific task, and no more. Blanket administrator rights across the entire OT environment are the opposite of this.
Monitored, on-demand remote access: Instead of a permanently open connection, CISA and the FBI recommend remote access that is activated only when needed and only after explicit authorisation by the operator, and that is fully logged and monitored. Always-on VPN tunnels into OT networks are now widely regarded in the field as an anti-pattern.
Operational resilience: Operators should keep offline backups of all critical software and regularly practise operating their facilities manually, without the integrator’s support. Only in this way does control over the physical processes remain intact even when the service provider fails or is compromised.
Complete asset documentation: The operator should maintain a full inventory of its hardware and software, including connection diagrams and update procedures. You can only protect what you know.
Context: not a niche issue, but supply chain security
The approach taken by CISA and the FBI is not a special case but part of a broader framework for supply chain security. The fact sheet explicitly references established foundations such as CISA’s asset inventory guidance for OT, NIST’s Cybersecurity Supply Chain Risk Management (documented among others in special publication NIST SP 800-161), and the use of Software Bills of Materials (SBOM).
The current NIST Cybersecurity Framework, in version 2.0, has given the topic a prominent place with the new Govern function and the Supply Chain Risk Management category (GV.SC). The message behind this is unambiguous: third-party risk is not a technical detail but a leadership responsibility that must be anchored at board and executive level.
The Swiss context
For Swiss critical infrastructure operators, the topic is directly relevant for two reasons. First, the risk applies regardless of location: Swiss energy providers, water utilities, hospitals, and transport operators work with external ICS integrators just as their American counterparts do, and attackers do not distinguish by national borders.
Second, the legal situation has changed. Since April 1, 2025, Switzerland has had a reporting obligation for cyberattacks on critical infrastructure. Operators must report an incident to the Federal Office for Cybersecurity (BACS) within 24 hours if it endangers the functionality of the infrastructure, which expressly includes the theft or manipulation of sensitive data as well as extortion attempts. The obligation is based on the Information Security Act and its associated ordinance and covers nine sectors, among them energy, water, health, finance, transport, and information and communication technology. After a sanction-free transition period until October 1, 2025, violations can result in fines of up to 100,000 francs. Only smaller companies below defined thresholds are exempt.
The connection to the CISA fact sheet is obvious: if a Swiss operator is attacked through a compromised integrator and sensitive facility data is stolen in the process, this is a reportable incident under the new rules. Sound third-party management is therefore no longer merely a matter of diligence but directly touches on regulatory compliance.
What operators and integrators should do now
For operators, the central measure is to systematically map the relationship with every integrator and to answer the four key questions honestly. From this, concrete steps follow: switching remote access from permanently open to on-demand, reducing access rights to the necessary minimum, adding security requirements to contracts, and practising manual emergency operation.
The integrators themselves are also called upon. Anyone working for critical infrastructure will increasingly be judged by how well they secure their own systems, their customers’ data, and their remote access routes. An integrator with a demonstrably solid security programme will have a competitive advantage in future, while a compromised service provider becomes a reputational risk for the entire sector.
The full guidance from the FBI and CISA is freely available: Considerations for Critical Infrastructure Operators Working with Third-Party ICS Integrators (CISA/FBI, September 2026)
Do you operate critical infrastructure or OT environments and work with external integrators? Contact us for a review of your third-party and remote access management.
Sources:
– CISA/FBI: Considerations for Critical Infrastructure Operators Working with Third-Party ICS Integrators
– BACS: Reporting obligation for cyberattacks on critical infrastructure
– NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices
– CISA: ICT Supply Chain Risk Management