10/14/2026
CISA and the FBI issued a fact sheet on working with third-party ICS integrators. The core recommendation is one sentence: grant only the minimum access necessary, and no more.
Easy to agree with, but harder in practice.
Vendor access tends to be scoped broadly because narrowing it takes extra work, provisioned fast because time is money, and never removed because nobody owns the offboarding.
Least privilege is only as strong as its weakest enrollment path.