On an oil or gas rig, control software runs pumps, valves and monitoring equipment, so a weak component can affect physical processes. Remote locations, systems assembled by integrators and long equipment lives make provenance hard to see. Ask integrators for component lists, and plan patching around limited connectivity and safety review.
This is general guidance. It describes no specific rig, company or incident, and it leaves out regulations we did not read.
What makes rigs different?
CISA's Energy Sector page divides energy infrastructure into three interrelated segments: electricity, oil and natural gas. It notes heavy reliance on pipelines and the interdependencies with the Transportation Systems Sector. Other sectors depend on energy, so a disruption travels.
Three features make the software supply chain tricky offshore and in the field.
Integrator-built systems. A rig's control environment is often assembled by an integrator from vendor products. CISA and the FBI have published a fact sheet for critical infrastructure organizations working with third-party ICS integrators to reduce risk, listed on CISA's industrial control systems page. We did not read the fact sheet itself here, but its existence tells you CISA treats integrators as a distinct risk point.
Limited connectivity. Satellite links are slow and expensive. Pulling a large update, or an advisory feed, may be impractical. That favors planned update windows and local mirrors.
Long equipment life. Software on a platform can outlive its vendor's support. Components inside may be years past their last release.
How does a software flaw become a safety matter?
NIST's SP 800-82 Revision 3 frames OT as systems that interact with the physical environment and says security guidance must account for performance, reliability and safety. A control system that misreads a sensor or ignores a command is a process problem. That is why a security finding on this equipment goes through engineering review rather than an automatic patch.
The ISA/IEC 62443 series offers a vocabulary. By its titles on ISA's page, Part 3-2 covers security risk assessment for system design, Part 3-3 system security requirements and security levels, Part 2-4 requirements for service providers, and Part 4-1 and 4-2 supplier lifecycle and component requirements. Read the standards before putting clauses in a contract.
What should you ask an integrator?
- A component list for each delivered system, in SPDX or CycloneDX, with firmware build numbers.
- How vulnerabilities in those components will be reported to you, and how fast.
- What remote access the integrator keeps after commissioning, who holds the credentials and how it is logged.
- How software is delivered on site and how integrity is verified.
- How long each product version is supported.
CISA describes an SBOM as a nested inventory, a list of the ingredients that make up software components. For a rig, the practical question is simpler: if an advisory arrives tomorrow, can you tell which of your systems are affected?
How do you patch with little bandwidth?
Pre-stage updates onshore, test them on a matching unit, verify checksums and carry them out on a controlled medium or deliver them through a monitored link. Plan for turnaround maintenance windows. Record every change with version before and after.
Where a flaw cannot be fixed soon, use compensating controls: block the affected service at the network boundary, restrict who can reach the device and monitor for abnormal traffic.
What to do
- List every programmable system on the platform with vendor, model and firmware version.
- Mark who integrated each system and who holds remote access.
- Request component lists and advisory commitments in writing from integrators.
- Close or log unused remote access paths, and require multi factor authentication where supported.
- Pre-stage and verify updates onshore, and test them on a matching unit.
- Schedule updates inside planned maintenance windows with a rollback plan.
- Document compensating controls for anything unpatchable, with an owner and a review date.
- Run an advisory drill: pick a real advisory and time how long it takes to learn which systems are affected.
Quick check
Why are integrators a special concern?
They assemble many vendor products and often retain remote access, so their practices shape your exposure. CISA has published guidance specifically on working with third-party ICS integrators.
How can a remote site handle patching?
Pre-stage and test updates onshore, verify integrity, and apply them in planned windows, with compensating controls for anything that must wait.
Sources
- Energy Sector, CISA, fetched 18 October 2026
- Industrial Control Systems, CISA, fetched 18 October 2026
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, fetched 18 October 2026
- ISA/IEC 62443 series of standards, ISA, fetched 18 October 2026
- Software Bill of Materials (SBOM), CISA, fetched 18 October 2026
Last reviewed: 18 October 2026.
