CISA and the FBI released guidance on September 23, 2026 for critical infrastructure organizations working with third-party industrial control systems integrators.
What changed
The fact sheet recommends limited privileges, monitored access routes, clear cybersecurity expectations in contracts, and inventories of vendor-supplied hardware and software. It also calls for reducing public internet exposure and practicing manual operations and recovery procedures.
Why it matters
Integrators may design, support, or operate systems that control physical processes. Their access can become a path to equipment and critical functions if it is broader than necessary or difficult to monitor.
What deserves attention
- Document who can connect, through which route, and to which equipment.
- Clarify responsibilities for patching, data storage, and approved personnel.
- Understand vendor dependencies in recovery and manual operations.
Panther Note: applying the lesson
This release specifically addresses industrial control systems; it is not a new general mandate for clinics or small businesses. Our broader takeaway is to make vendor access understandable and reviewable, with a named owner and a practical recovery plan.