The integrator can inherit operational authority
ICS integrators may design systems, program SCADA, support devices, analyse operational data or perform daily control activities. A secure tunnel does not constrain what an authenticated third party can do once connected.
The control objective is therefore bounded authority: named identity, approved device, explicit target assets, time-limited access, least privilege and a session record that can be reconstructed after an incident.
Supplier compromise can become customer compromise
The joint guidance cites an intrusion into an industrial automation company where actors searched for customer and SCADA information and staged hundreds of files. That creates a downstream risk even without direct access to the final operator.
OT supplier governance should consequently cover where customer data is stored, how engineering files are protected, how remote access is revoked, how patches are handled and what happens operationally if the integrator becomes unavailable or untrusted. Offline backups and manual operation are resilience controls, not administrative extras.
Sources & further reading
Continue this decision.
Move from this analysis into a curated route across related incidents, evidence and operating constraints.