Car factory cybersecurity: ask your integrators these questions first

In a car factory, inspect your outside parties first. Assembly lines are built by integrators, run with supplier software and supported by vendors who connect remotely. Ask who can reach each cell, what software they installed, and how you would know if it changed. IEC 62443 and CISA guidance give the language.

Why start with third parties here?

Vehicle plants are assembled from many systems built by different companies: line integrators, equipment makers, software suppliers and maintenance providers. That is a structural fact about the industry, and it shapes the risk. The IEC 62443 series from ISA names asset owners, system integrators and product suppliers as separate stakeholder groups, each with different responsibilities. CISA publishes a fact sheet on considerations for critical infrastructure operators who work with third-party ICS integrators, aimed at protecting the operational environment during that work. Read both before your next integrator meeting.

No incidents are discussed here. The article uses only guidance that was checked.

Question set 1: access

• Which vendors have remote access to which cells, and by what mechanism? Get a list with names, not a policy.
• Is each connection approved per session, or always on? CISA's grid guidance advises avoiding persistent vendor connections into control networks and keeping remote access operator-controlled and time-limited.
• Who revokes accounts when a vendor employee leaves, and how do you know?

Question set 2: software and updates

• What software did the integrator install on each controller, workstation and robot cell, and at which versions? Ask for a bill of materials, or at least a list of components.
• How are updates delivered and verified? A vendor laptop plugged into the line is a software supply path, whatever the contract says.
• Where do project files and controller programs live, and how do you detect that one changed? Version control and hashes beat memory.

NIST's guidance on cybersecurity supply chain risk management, SP 800-161 Revision 1, addresses risks from products and services that may contain malicious functionality or be vulnerable through poor development practices. It is general-purpose, but its framing helps procurement write requirements into contracts.

Question set 3: what happens when the line stops

NIST SP 800-82 reminds us that OT must meet performance, reliability and safety requirements. For a plant that runs to a schedule, ask each vendor how fast they can respond, what you do in the meantime, and who decides to stop the line. Practice it once with the vendor on the phone.

A note on the software around the line

Plants also run ordinary applications: scheduling, quality data, traceability and dashboards. These have dependency trees like any other software. An inventory of those dependencies and reachability analysis tell you which known flaws sit on code that is actually exposed, and which are on a system behind several layers of separation. Document those conclusions so your team does not reargue them at every disclosure.

What to do

1. List every vendor, integrator and supplier with access, by cell and by method.
2. Move remote access to approved, time-limited sessions with strong multi-factor authentication.
3. Request a software inventory for each cell and compare it to what is installed.
4. Define how vendor updates are delivered, verified and logged.
5. Store controller programs in version control and detect unexpected change.
6. Write response expectations and stop-the-line authority into contracts.
7. Run one joint exercise with a vendor.
8. Review CISA's third-party integrator fact sheet with procurement and plant engineering together.

Quick check

Sources

• ISA: ISA/IEC 62443 series of standards
• CISA: Industrial control systems (links to the third-party integrator fact sheet)
• NIST SP 800-161 Revision 1
• NIST SP 800-82 Revision 3
• CISA: IR-ALERT-H-16-056-01 mitigations

Last reviewed: 18 October 2026.