New guidance on industrial integrators, reported manipulation at two small water utilities, and updated OT security guidance all point to the same issue: organizations need evidence of who can reach each operational asset, through which path, and under whose control.
TL;DR
- FBI and CISA guidance published on 23 September urges critical-infrastructure operators to apply least privilege to industrial integrators, monitor and log remote access, use on-demand access where possible, and retain the ability to operate without the integrator.
- Two small U.S. water utilities were reportedly manipulated in late August. Equipment settings, alarms, remote access, and pumping cycles were affected, but officials reported no impact on service, safety, treatment, or water quality. Attribution remains unconfirmed.
- CISA released nine industrial advisories during the week, covering embedded networking components, industrial management software, and an open control platform.
- NIST published an initial public draft of SP 800-82 Revision 4, expanding its sector coverage and strengthening guidance on governance, asset management, monitoring, management functions, and architecture.
- Recent vendor research points to persistent visibility gaps. One telemetry study found that few observed segments containing OT devices were OT-only, while a separate global survey reported that only 21% of respondents had a complete OT asset inventory. These are vendor findings, not universal benchmarks.
The access path is part of the operational system
Industrial organizations depend on outside expertise. Integrators configure control systems, vendors diagnose machines, and service teams restore equipment when production is under pressure. That access creates real operational value, but it also becomes part of the system that must be governed and recovered.
This week’s developments make the gap easier to see. A trusted third party can hold sensitive schematics and retain pathways into industrial environments. A small utility can experience direct changes to operational settings without a large enterprise network being involved. An asset inventory can look complete while connected devices or cross-segment routes remain undocumented.
The practical question is not whether remote access exists. It is whether the organization can show who has access, limit that access to the required assets and time window, review what happened, and continue operating if the third party is unavailable.
What does the new integrator guidance change?
On 23 September, the FBI and CISA published a fact sheet for critical-infrastructure operators working with third-party industrial control system integrators. The agencies based the advice partly on a 2025 compromise of a U.S. industrial automation company.
According to FBI technical analysis, foreign actors searched for customer and SCADA material and prepared roughly 800 files for presumed exfiltration.
The guidance is useful because it treats integrator access as a business dependency, not only a technical connection. It asks what data the integrator stores, where that data resides, whether the integrator has remote operational access, and whether the operator can run and recover systems independently if the integrator is compromised.
The recommended controls are equally concrete: put cybersecurity requirements into contracts, document supplied hardware and software, reduce external exposure, monitor and log remote routes, and use on-demand access where possible. The agencies also recommend practising manual operations and retaining secure offline copies of the software needed for recovery.
Read the FBI and CISA fact sheet.
What do the water incidents tell OT leaders?
Reporting published during the week described late-August intrusions at two privately owned water utilities in Colorado, each serving fewer than 200 people.
A spokesperson for the state governor’s office said attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The incidents were brief, and officials reported no effect on public safety, water service, treatment, or water quality.
Important details remain limited. The affected organizations were not named, the initial access path was not disclosed, and attribution was not confirmed. The cases should therefore not be used to make claims about a specific threat group or failed control.
They do show why consequence matters more than company size. A small, distributed site may have few users and limited security capacity, yet changes to alarms or pumping cycles can still create operational risk.
For leaders, the immediate test is whether remote pathways are known, changes are visible, and local teams can regain control quickly.
Sources: state-spokesperson reporting and independent follow-up coverage.
Why do industrial advisories keep returning to visibility?
CISA released nine industrial control system advisories on 22 September. The set covered an embedded TCP/IP component, several industrial platforms, and an open control runtime.
One advisory republished a critical authentication weakness in industrial edge-management software. The vulnerability could allow an unauthenticated attacker to take over an account through a password-reset process.
The original vendor advisory was published earlier in September, so this was a broader government publication rather than a newly discovered flaw.
The operational difficulty is rarely the advisory alone. Teams must know whether the affected component exists, which asset or management function depends on it, whether it is externally reachable, and who owns the update decision.
Embedded components make this harder because the vulnerable code may sit inside a larger product that the operator did not build and cannot patch directly.
Review the CISA advisory release and the original product security advisory.
Are OT segments real security boundaries?
Two recent vendor studies add useful, if qualified, context.
A telemetry analysis of 47,700 network segments reported that only 13% of observed segments containing OT devices were OT-only. A separate survey of more than 600 industrial cybersecurity, risk, compliance, and operations leaders reported that 21% had a complete OT asset inventory.
These figures come from vendors with their own datasets and definitions, so they should not be treated as universal industry measurements.
The underlying questions are still worth asking: does the inventory include the routes used by vendors and integrators, and has the organization tested whether a segment actually limits reachability?
A VLAN name or architecture diagram is not proof of isolation.
Sources: network-segmentation telemetry analysis and global OT cybersecurity survey summary.
What is new in NIST SP 800-82 Revision 4?
NIST published the initial public draft of SP 800-82 Revision 4 on 21 September.
The draft expands its sector coverage to building systems, water, food and agriculture, freight rail, maritime vessels, industrial internet of things, and cloud convergence. It is also reorganized around the NIST Cybersecurity Framework 2.0, with more attention to governance and enterprise risk.
The draft strengthens guidance on asset management, network monitoring, management functions, and security architecture.
That matters because OT security evidence must connect policy to operational reality: named asset owners, known access routes, controlled management interfaces, visible activity, and tested recovery.
The public comment period runs through 30 November 2026.
Read the NIST publication page and draft.
What should OT leaders do now?
- Map integrator dependency. Record which third parties hold operational data, administer systems, or retain remote access. Include the business owner and the assets each relationship supports.
- Replace standing access where possible. Require approval for each external session, set a clear time window, and limit access to the specific asset needed for the task.
- Test the evidence chain. Select one vendor session and confirm that the organization can trace the approved user, target asset, connection time, activity, and closure through audit logs.
- Validate boundaries. Test whether intended OT segments restrict pathways from IT, vendor, wireless, cellular, and management networks. Add any connections discovered to the asset inventory.
- Practise without the third party. Confirm that local teams have the software, backups, authority, and procedures needed to operate or recover critical processes when an integrator is unavailable.
Where secure external access fits
No remote-access platform can remove third-party risk or compensate for an unknown asset estate. It can, however, make external access easier to govern.
Secomea helps manufacturers control vendor access at the asset level, require approval before a session, connect enterprise identity to OT access, and retain audit logs and session records.
The useful outcome is operational: the right expert can reach the right asset without receiving broad network access, while the asset owner keeps visibility and control.
An edge gateway and tunnel proxy can enforce that route close to the industrial environment, rather than extending a general-purpose connection across the production network.
Explore secure OT remote access, monitoring and control of remote sessions, and remote access for utilities and critical infrastructure.
Frequently asked questions (FAQ)
Frequently asked questions (FAQ)
What is third-party OT access?
Third-party OT access is a connection that allows an outside integrator, vendor, machine builder, or service technician to reach industrial systems or assets for design, support, maintenance, monitoring, or recovery.
Why is standing vendor access risky?
Standing access remains available outside an active service task. If credentials, the vendor environment, or the connection path are compromised, that persistent route can increase the opportunity for unauthorized access.
What is on-demand remote access?
On-demand remote access requires an operator or authorized owner to enable or approve access for a defined task and period. It reduces unnecessary exposure while preserving fast support when needed.
How can an organization prove control of OT remote access?
Useful evidence links an approved identity to a specific asset, purpose, time window, session, and outcome. Audit logs, approval records, asset-level permissions, and session records help establish that chain.
