You've probably seen the CISA-FBI advisory about the integrator breach. Now your team is buzzing with questions about its impact on your existing OT vendor relationships. Here's what procurement security teams managing industrial control systems and SCADA environments are asking, and what you need to know.
Understanding the Source of Concerns
The advisory details how foreign actors compromised a U.S. industrial automation integrator between March and April 2025, targeting customer SCADA information and ICS device details. The attackers searched for terms like "customers" and "SCADA" and packaged about 800 files for presumed exfiltration. This wasn't random ransomware; it was reconnaissance for future attacks against critical infrastructure clients.
This timeline and target selection have OT procurement teams revisiting every active integrator contract. These questions reflect what you're likely discussing internally.
Q1: "Do we know which integrators have remote access to our OT environment right now?"
Start with an access inventory, not just a vendor list. Your procurement records show who you've contracted with, but your network logs reveal who's actually connecting. Compare the two.
Gather three data points for each remote connection: the integrator's name, what systems they can access, and when they last authenticated. If your IT team can't produce this list in 48 hours, you lack adequate visibility into your OT attack surface. The advisory warns about third-party access as a vector; you can't assess that risk if you don't know who's connected.
Q2: "Should we cut all remote integrator access until we review contracts?"
Not immediately. Implement session monitoring and approval workflows this week. Cutting access without planning creates operational risk; an unplanned SCADA maintenance delay can cost more than the security improvement you're aiming for.
Instead, enforce the least privilege principle as the advisory recommends: require integrators to request access for specific tasks with defined time windows. If an integrator needs to troubleshoot a PLC issue, they should get access to that PLC subnet for the duration of the work, not standing access to your entire OT network. Your remote access tool should support time-boxed sessions. If it doesn't, that's your next procurement priority.
Q3: "What contractual language enforces these security measures?"
Your existing Right to Audit clauses likely cover financial and compliance reviews, but you need language that explicitly grants you the right to audit the integrator's security controls and incident response procedures. Include:
- Mandatory asset inventory requirements: The integrator must maintain and share a current list of all systems they've accessed, including make, model, and software version.
- Notification timelines: Define what constitutes a security incident affecting your environment and require notification within a specific timeframe (24 hours is standard for critical infrastructure).
- Access revocation procedures: You must be able to terminate integrator access immediately without waiting for contract renegotiation.
- Sub-outsourcing restrictions: If your integrator uses subcontractors for remote support, you need visibility into those arrangements.
Review your active contracts this quarter. If these provisions are missing, you're operating with supply chain risk you can't measure.
Q4: "Should we limit what integrators can take offsite?"
Yes, but be specific about what stays in your environment versus what they can store. Integrators need design documentation to do their jobs, but you control how that information is handled.
Require that detailed network topology diagrams, device configurations with IP addressing, and credential documentation remain in your document management system. The integrator can access them during active projects but shouldn't maintain their own repository of your complete OT architecture. That's what made the compromised company valuable to attackers; they had comprehensive blueprints for multiple downstream targets.
For electrical and physical layout diagrams that don't expose network architecture, you can be more flexible. The risk isn't the conveyor belt layout; it's the network diagram showing how to reach the PLC controlling that belt.
Q5: "How do we implement this without breaking relationships with integrators we've worked with for years?"
Frame it as shared risk management, not distrust. Your integrators are targets precisely because of their access to multiple critical infrastructure clients. They should welcome measures that reduce their attractiveness to nation-state actors.
Schedule a joint security review with each major integrator. Walk through the advisory together and ask: "If your network were compromised tomorrow, what customer data would an attacker find?" Then collaborate on reducing that exposure. Good integrators will appreciate that you're taking their security seriously; resistant ones are telling you something about their maturity.
Q6: "Can we require these security measures without renegotiating pricing?"
It depends on what's already in scope. Basic measures like changing default passwords, maintaining asset inventories, and following least privilege shouldn't trigger change orders if they're part of your existing support agreement. Review your statement of work.
However, if you're asking the integrator to implement new monitoring tools, undergo third-party security assessments, or provide detailed logging that requires infrastructure changes on their end, that's additional work. Budget for it. The cost of scoping these requirements properly is substantially less than the cost of an incident that propagates through an integrator's access.
Q7: "Should we treat integrators differently than other third parties in our TPRM program?"
Yes. Integrators with remote OT access require a distinct assessment framework. Your standard SIG Core questionnaire addresses general security practices, but it doesn't capture the specific risks the advisory highlights: what client data the integrator stores, how they segment customer environments, and whether they've implemented network monitoring for lateral movement.
Add an OT-specific assessment module for any vendor with remote access to industrial control systems. Include questions about their incident response experience with nation-state threats, not just their ISO 27001 certification status.
Q8: "Does the mention of 'nation-state' actors change our response compared to criminal threats?"
It changes your threat model. Criminal actors typically want immediate monetization through ransomware or data theft. Nation-state reconnaissance, like what the advisory describes, involves patient information gathering to enable future operational disruption. The attackers weren't encrypting systems; they were mapping them.
That means your integrator relationships could be under surveillance right now without obvious indicators of compromise. You can't wait for an alert to take action. Implement the access controls and monitoring the advisory recommends as baseline hygiene, not incident response.
Next Steps
The full CISA-FBI advisory provides technical indicators and specific mitigations. If you're managing OT vendor relationships, review it alongside your integrator contracts this month. The measures it recommends are foundational security practices, but the advisory makes clear that foundational doesn't mean optional.
Your procurement security role puts you at the intersection of vendor relationships and operational risk. Use that position to ensure your integrator access controls match the threat environment those vendors now operate in.
