Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

Under NERC CIP-013, entities must work with suppliers, contractors, and OEMs to establish and enforce cybersecurity and supply chain risk management requirements for the procurement and handling of BES Cyber Systems and their associated EACMS and PACS. These requirements support the identification and assessment of cybersecurity risks associated with vendor products and services.

The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) published a fact sheet outlining considerations that critical infrastructure owners and operators should implement to reduce risk and minimize vulnerabilities when working with third-party industrial control system (ICS) integrators. Third-party integrators, including OEMs and vendors, provide a range of ICS services, such as control system design and installation, operational data analysis, device support and maintenance, and daily operational control.

Risk Assessment Considerations

Entity owners and operators should consider the following questions when assessing risks associated with third-party ICS integrators:

1. What BCSI or other sensitive information can the integrator access, process, transmit, or store?
2. Where does the integrator store utility data – within the United States or internationally?
3. Which laws and regulatory requirements apply to the integrator and the utility data, regardless of storage location?
4. Does the integrator have remote access to the entity’s environment?
5. Does the integrator use on-demand, time-bound, or continuous remote access?
6. Which assets, systems, or equipment can the integrator access, manage, or operate remotely?
7. Has the entity validated the integrator’s cybersecurity controls through an independent audit, security assessment, certification, or another verification method?
8. Does the entity understand the potential operational and cybersecurity consequences if a malicious actor compromises the integrator?
9. What redundancies, contingency measures, and recovery capabilities allow the entity to restore systems and maintain critical operations without support from the integrator?

Recommendations to Reduce Risk

The FBI and CISA recommend that critical infrastructure owners and operators take the following steps to reduce risks associated with third-party ICS integrators:

1. Include cybersecurity and supply chain requirements in contracts and service agreements. Define requirements for:
   • Data storage locations and protection of ICS data, configurations, diagrams, and design documentation;
   • Remote access methods, restrictions, monitoring, and approval requirements;
   • Minimum cybersecurity program requirements that the integrator must maintain;
   • Change management, vulnerability management, and patch management processes;
   • Security measures for deployed components, including changing default credentials and disabling unused ports, services, accounts, and protocols;
   • Identification of authorized personnel who can access the entity’s systems; and
   • Local engineering and operational support capabilities that reduce dependence on integrator intervention.
2. Evaluate devices with external internet exposure. Work with integrators to identify hosted and remotely accessible devices, determine whether those devices require internet connectivity, and remove unnecessary public-facing exposure. Restrict required connectivity through approved network paths and security controls.
3. Monitor and log remote access. Require integrators to access systems through routes that the entity can control, monitor, and log. Where feasible, implement just-in-time and time-bound access that requires entity approval before each remote session. Capture sufficient records to identify the user, source and destination systems, session start and stop times, and activities associated with remote access.
4. Request an inventory of all hardware and software. Maintain an inventory of hardware, software, firmware, and software dependencies supplied or managed by the integrator. Document each component’s connection to the entity’s infrastructure, operational purpose, responsible vendor, support status, and software or firmware update process. Request a software bill of materials (SBOM) when appropriate to improve visibility in software components and dependencies.
5. Maintain independent operational and recovery capabilities. Develop and exercise procedures that allow personnel to maintain or restore critical operations when an integrator cannot provide support. Include manual operating procedures where practical, identify third-party dependencies within recovery plans, and confirm that personnel can execute recovery activities without relying exclusively on the integrator.