IT and OT: How Plants Differ, and the Purdue Model

Standards and guidance described in this lesson: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023, still the current final version; NIST released Rev. 4 as an initial public draft on Sept. 21, 2026, with comments due Nov. 30, 2026); ISA-95 (ANSI/ISA-95, adopted internationally as IEC 62264) as ISA describes it; the ISA/IEC 62443 series as ISA lists it, including ANSI/ISA-62443-2-1-2024; the Purdue Reference Model for CIM (Williams, 1989) and the Purdue Enterprise Reference Architecture (Technical Report 154, December 1991); CISA and partners, "Primary Mitigations to Reduce Cyber Threats to Operational Technology" (May 6, 2025) and advisory AA26-097A (April 7, 2026, updated July 22, 2026). All read Oct. 28, 2026. Standards, guidance and threat data change; check the current version before relying on any point.

This is the first of seven lessons on keeping factories, plants, utilities and pipelines safe from cyberattack. It is written for the people who run those places and the people who ask questions about them: plant managers, controls engineers, maintenance technicians, IT staff who have just been handed the plant floor, owners of small Idaho manufacturers, the integrators and vendors who serve them, and reporters, advocates and local officials. It does not assume you are an engineer. Every term is explained the first time it appears.

If you need the basics of computer security first (updates, passwords, two-step sign-in, backups, scams), start with Home Computer Security and the opening lesson of Small Business Data Security, Your Data and Layered Defense. This lesson does not repeat them. It goes where those lessons stop: the machines, controllers and networks that make things.

What operational technology is

A definition from NIST

The National Institute of Standards and Technology (NIST), the federal agency that writes much of the country's cybersecurity guidance, publishes the main U.S. government guide to plant cybersecurity. Its current final version is NIST Special Publication 800-82 Revision 3, Guide to Operational Technology (OT) Security, published in September 2023.¹ Its opening sentence is the clearest short definition available: "OT encompasses a broad range of programmable systems and devices that interact with the physical environment (or manage devices that interact with the physical environment)." NIST's examples are industrial control systems, building automation systems, transportation systems, physical access control systems, and systems that monitor or measure the physical environment.¹

The key words are "physical environment." An email server handles information. A programmable logic controller on a bottling line opens a valve, starts a motor and decides when a capper has turned far enough. If the email server fails, people lose messages. If the controller fails or is told to do the wrong thing, product is ruined, a machine is damaged, or someone is hurt.

The title of NIST's guide changed with the latest revision. Revision 2 was called Guide to Industrial Control Systems (ICS) Security. Revision 3 lists as its first change an "Expansion in scope from industrial control systems to operational technology (OT)."¹ That shift matters for readers outside heavy industry. The heating and cooling controls in a hospital, the badge readers on a school, the controllers in a data center's cooling plant and the irrigation pumps on a large farm are all OT, even though none of them is a factory. The building systems side is covered from a different angle in the data center lesson on what is inside the building.

NIST is already revising the guide again. On Sept. 21, 2026, it released an initial public draft of Revision 4, open for comment through Nov. 30, 2026. NIST says the draft expands coverage to building automation, water and wastewater, food and agriculture, freight rail, maritime vessels and "Industrial Internet of Things (IIoT) and cloud convergence," and reorganizes the guide around version 2.0 of the NIST Cybersecurity Framework.¹² Until NIST finalizes it, Revision 3 is the version to cite.

ICS, SCADA, DCS: the family names

Plant people use several overlapping terms. Here is how NIST's glossary sorts them.¹³

• Industrial control system (ICS): the umbrella term. NIST calls it a "General term that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations" such as programmable logic controllers.
• SCADA (supervisory control and data acquisition): "A generic name for a computerized system that is capable of gathering and processing data and applying operational controls over long distances." Think of a water utility watching dozens of wells and tanks across a county from one control room, or a pipeline company watching hundreds of miles of pipe. NIST notes that typical uses include power transmission and distribution and pipelines.
• DCS (distributed control system): control "achieved by intelligence that is distributed about the process to be controlled, rather than by a centrally located single unit." A DCS is usually one vendor's integrated system running a big continuous process in one place: a refinery, a pulp mill, a large sugar factory.
• OT (operational technology): the widest term. It includes every kind of ICS plus building, transportation, access control and monitoring systems.

In practice, people say "ICS" and "OT" almost interchangeably, and this module does too. When the difference matters (for example, a security rule that covers only "industrial automation and control systems"), the lesson will say so.

What OT is not

Two confusions come up often. First, OT is not the same as "smart" consumer devices. A home thermostat with an app is an Internet of Things device; a factory's networked vibration sensor feeding a maintenance system is part of the Industrial Internet of Things, which NIST treats as a subset of OT (more on that below). Second, OT is not only old equipment. A brand-new robot cell, a new packaging line delivered last month, and a cloud-connected sensor package are all OT. The age problem described in this lesson is real, but plants also add new connected equipment every year, and new equipment can bring new exposure.

How OT differs from office IT

NIST's guide has a section titled "Comparing OT and IT System Security." It starts with history: OT "had little resemblance" to IT when plants ran isolated networks with "proprietary control protocols using specialized hardware and software." Cheap Ethernet, Internet Protocol (IP) and wireless gear replaced those older technologies, and OT began "using industry standard computers, OSs, and network protocols." That integration, NIST says, "provides significantly less isolation for OT from the outside world than predecessor systems, creating a greater need to secure them."² The plant now looks like IT on the wire, but it does not behave like IT. The differences below are the reason a plant cannot simply be handed to the IT department and secured with the same playbook.

Safety and availability come first

Security people often describe IT goals as the "CIA triad": confidentiality (keep secrets secret), integrity (keep data accurate) and availability (keep systems up). NIST says that in a typical IT system, "primary concerns include data confidentiality and integrity." For OT, the list is different: "safety, fault tolerance to prevent the loss of life or endangerment of public health or confidence, regulatory compliance, loss of equipment, loss of intellectual property, or lost or damaged products."²

Two sentences from NIST belong on the wall of any plant security meeting. The first: "Any security measure that impairs safety is unacceptable." The second, on availability: "Many OT processes are continuous in nature. Unexpected outages of systems that control industrial processes are unacceptable. Outages must often be planned and scheduled days or weeks in advance."²

That changes ordinary security habits. In an office, if a computer acts strangely, the help desk restarts it. NIST says "typical IT strategies (e.g., rebooting a component) are usually not acceptable for OT." A continuous process (a kiln, a sugar evaporator, a cheese vat, a chemical reactor) can be damaged or spoiled if a controller stops in the middle. In some cases, NIST notes, "the products produced or equipment being used are more important than the information being relayed."²

It also changes what "worst case" means. In an office, the worst case is usually stolen data, ransom and downtime. In a plant, the worst case is a fire, a toxic release, a crushed hand or a contaminated water supply. That is why every recommendation in this module that would change a plant system comes with the same reminder: plan it with the equipment vendor, your safety lead and qualified controls and process safety engineers, and test it before it touches production. Lesson 5, on patching and safety together, is built around that idea.

Equipment that lasts decades

NIST: "Typical IT components have a lifetime on the order of three to five years due to the quick evolution of technology. For OT, where technology has been developed in many cases for specific uses and implementations, the lifetime of the deployed technology is often in the order of 10 to 15 years and sometimes longer."² The 2024 edition of the international standard for plant security programs, IEC 62443-2-1, goes further: its official abstract says "the lifespan of an IACS can exceed twenty years" and that "many legacy systems contain hardware and software that are no longer supported."¹⁴

Walk through almost any Idaho plant built before 2010 and you will find a control room PC running an operating system its maker stopped patching years ago. That is rarely carelessness. The PC runs the vendor's HMI software, the software was certified only on that operating system, and replacing it means replacing the controllers it talks to, re-testing the whole line and possibly revalidating a regulated process. NIST notes that "many OT utilize older versions of OSs that are no longer supported by the vendor through patches."² The money and downtime needed to modernize are real, and they compete with every other capital project.

Real-time limits

Office networks care about throughput: moving a lot of data quickly, with small delays nobody notices. Control networks care about timing. NIST: "Some systems require reliable, deterministic responses. High throughput is typically not essential to OT." Many OT devices run real-time operating systems, where "real-time refers to timeliness requirements."² A controller that reads a sensor and moves a valve has to do it on schedule, every cycle. A security tool that adds delay, floods the network with scan traffic or uses the controller's limited memory can break that timing. NIST warns: "Indiscriminate use of IT security practices in OT may cause availability and timing disruptions."²

The same section notes that OT devices are often "resource-constrained systems that do not include typical contemporary IT security capabilities," and that many lack "encryption capabilities, error logging, and password protection." There may be no room on the device to add them.²

Change and patching

In an office, security updates arrive on Tuesday and are installed by Thursday, often automatically. NIST: "Software updates on OT cannot always be implemented on a timely basis. These updates need to be thoroughly tested by both the vendor and the end user of the industrial control application before being implemented." The plant "must plan and schedule OT outages days or weeks in advance," and the system "may also require revalidation as part of the update process."² Changes to firmware and hardware go through the same careful process, which NIST says "requires careful assessment by OT experts (e.g., control engineers) working in conjunction with security and IT personnel."² How to keep a plant reasonably current without stopping it is the subject of lesson 5.

Vendors and support contracts

IT departments can usually pick among many vendors and tools. In OT, NIST says, "service support is sometimes only available from a single vendor," and "In some instances, third-party security solutions are not allowed due to OT vendor licensing and service agreements, and service support can be lost if third-party applications are installed without vendor acknowledgement or approval."² Installing a favorite antivirus product on an HMI computer can void the support contract for the line. Before anyone adds a security tool to plant equipment, the equipment vendor has to agree, in writing. Lesson 4, on remote access, vendors and the supply chain, covers how to manage that relationship.

Who owns the plant network

This is the difference that causes the most friction in real companies. NIST: "OT OSs and control networks are often quite different from their IT counterparts and require different skill sets, experience, and levels of expertise. Control networks are typically managed by control engineers rather than IT personnel. Assuming that differences are insignificant can have disastrous consequences on system operations."²

In a typical mid-size plant, the IT department reports to a chief information officer or the finance side and owns email, laptops, the business network and the enterprise resource planning (ERP) system. The plant floor reports to the plant manager or operations: controls engineers, maintenance technicians, and outside system integrators who programmed the lines. Each side has good reasons for its habits. IT knows how attackers get in and how to manage thousands of accounts. Engineering knows what will hurt someone or break the process, and why a change that looks harmless on paper can stop a line. Plants that do security well build a team that includes both, with clear rules about who can change what. NIST's guide recommends a cross-functional team for exactly this reason (lesson 2 covers that part of the guide).

Industrial protocols at a glance

A protocol is the agreed "language" two devices use to talk. Office networks mostly speak web, email and file-sharing protocols. Plant networks also speak industrial protocols built for reading sensor values and sending commands. You do not need to know how they work to follow this module, only their names and one fact: many were designed for closed networks, and security has been added later, unevenly.

NIST notes that OT-specific firewalls "often provide built-in parsers for common OT protocols, such as DNP3, CIP, and Modbus, allowing for deep packet inspection of OT traffic," meaning the firewall can understand whether a message is a harmless read or a command to change something.¹⁶ CISA and its partner agencies put the problem bluntly in a 2025 fact sheet: "OT devices lack authentication and authorization methods that are resistant to modern threats."²⁰ Most of the newer secure versions exist; the hard part is that a plant with 15-year-old controllers cannot switch them on.

The parts of an industrial control system

An industrial control system is a chain. At one end is the physical process: water, product, heat, pressure, motion. At the other end are people and business systems that decide what the plant should make and how much. In between are devices that measure, decide and act. NIST's guide walks through SCADA, DCS and PLC systems in its Section 2.3.²¹ Here are the parts, in plain language, from the bottom up.

Sensors and actuators: the plant's senses and muscles

A sensor (instrument people often say "transmitter") measures something and turns it into a signal: temperature, pressure, level in a tank, flow in a pipe, the speed of a conveyor, whether a guard door is closed. An actuator makes something move: a valve opens or closes, a motor starts, a variable frequency drive (VFD) speeds a pump up or down, a solenoid pushes a reject arm. NIST groups these with the controllers that serve them as field devices: "Equipment that is connected to the field side on an ICS."¹³

Sensors and actuators sit at Purdue Level 0, the physical process. NIST makes a point that surprises many IT people: "Many of the devices and the communication protocols at the Field I/O level (Purdue Level 0) (e.g., sensors, actuators) cannot be authenticated. Without authentication, there is the potential to replay, modify, or spoof data." A controller generally believes what its sensors tell it. NIST suggests deciding, by risk, where to add checks such as a separate monitoring network or a "digital twin" model that can flag readings that do not make physical sense.²²

The PLC: the small computer that runs the machine

The programmable logic controller (PLC) is the workhorse of American manufacturing. NIST's glossary, quoting the ISA dictionary, calls it "A solid-state control system that has a user-programmable memory for storing instructions for the purpose of implementing specific functions such as I/O control, logic, timing, counting, three mode (PID) control, communication, arithmetic, and data and file processing."¹³ In plainer words: a rugged box, built for heat, dust and vibration, that reads its inputs, runs a program over and over in a fast loop, and sets its outputs. If the tank is low, open the fill valve. If the guard door opens, stop the press. If the temperature drifts, nudge the steam valve.

NIST notes that PLCs "can also be implemented as the primary controller in smaller OT system configurations to provide operational control of discrete processes (e.g., automobile assembly lines, process controllers)."²¹ In a small Idaho shop, there may be no DCS and no SCADA, just a handful of PLCs, each running one machine, with a screen beside each. That is still an industrial control system, and it still needs protecting.

Two features of PLCs come up again and again in security advisories. First, many PLCs have a physical key switch or mode setting (run, program, remote) that controls whether the program can be changed. Second, many newer PLCs include built-in network services. NIST recommends turning off what is not used: "a web server or SSH server may be available in some newer PLCs or HMIs. If these services are not used, they should be disabled."²² In 2026, federal agencies told owners of one widely used controller line to "place the physical mode switch on the controller into run position" during a wave of attacks, a simple step that blocks remote program changes on those devices.²³

RTUs and SCADA: control over long distances

A remote terminal unit (RTU) is a field computer at a remote site: a well house, a lift station, a pipeline valve, a substation. NIST's glossary defines it as "A computer with radio interfacing used in remote situations where communications via wire is unavailable," and notes that PLCs with radio links are also used in place of RTUs.¹³ The RTU reports readings and accepts commands from a central SCADA system. NIST explains that the central server in a SCADA system is "often called a SCADA server, MTU, or supervisory controller," and that a SCADA control center includes "the HMI, engineering workstations, and the data historian."¹³²¹

SCADA is how a city in Idaho runs its water system, how an irrigation district watches its canals, and how a gas or power utility watches its network. The communication links (licensed radio, cellular modems, leased lines, fiber, sometimes the public internet) are long and hard to guard. The grid side of this is explained in the power grid lesson, From Power Plant to Outlet.

The DCS: one system for a big continuous process

A distributed control system spreads control across many controllers, each handling a section of the process, all tied together by the vendor's own network and engineered as one system. A refinery, a paper mill or a large food plant running a continuous process may use one. The operator sees the whole process on consoles in a central control room. Because a DCS is usually one vendor's design, its security depends heavily on that vendor's patches, approved antivirus lists and support contracts, the vendor issue described above.

The HMI: the operator's window

The human-machine interface (HMI) is "The hardware or software through which an operator interacts with a controller." NIST says it can range from a physical panel with buttons and lights to an industrial PC with color graphics.¹³ On a modern line, the HMI is usually a touchscreen showing a picture of the process, with numbers, alarms and buttons. Operators use it to start and stop equipment and to change set points (the target values the controller holds, such as a temperature).

The HMI matters for security because it is the system people trust. In the 2026 attacks described in CISA advisory AA26-097A, federal agencies said attackers disrupted PLCs "through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss."²³ If the screen can be made to show the wrong thing, the operator may act on bad information or fail to act.

The historian: the plant's memory

A data historian is "A centralized database that supports data analysis using statistical process control techniques."¹³ It records readings from the controllers, often every second, for years. Quality staff use it to prove a batch was made correctly; engineers use it to find why a line stopped; managers use it for production reports. Because so many people want historian data, the historian is often the system with the most connections to the business network, and so one of the systems that most needs careful placement. CISA's 2025 fact sheet tells operators to segment IT and OT, including "introducing a demilitarized zone for passing control data to enterprise logistics."²⁰ Placing a copy of historian data in that zone, so business users never reach into the plant, is one common way to do it.

The engineering workstation: the keys to the controllers

NIST does not give the engineering workstation its own glossary entry, but describes it in Section 2.3: in PLC systems, "The PLC is accessible via a programming interface located on an engineering workstation."²¹ It is the computer, often a laptop, that holds the vendor's programming software and the "project files" for every controller. Whoever controls it can change what the machines do. That is why it is a prime target. In the 2017 attack on safety controllers at a foreign refinery (lesson 3 tells the story), CISA's analysis advised that the safety system's engineering workstations should not be connected to larger networks.²⁴ Treat the engineering workstation and the project files as the most sensitive items in the plant.

The safety instrumented system: the last automated line of defense

Some processes can kill people if they go wrong: high pressure, flammable gas, toxic chemicals. For those, plants add a safety instrumented system (SIS), defined by NIST as "A system that is composed of sensors, logic solvers, and final control elements whose purpose is to take the process to a safe state when predetermined conditions are violated." It goes by other names too: emergency shutdown system, safety shutdown system, safety interlock system.¹³

NIST explains that an SIS "is often independent from all other control systems in such a manner that a failure of the basic process control system (BPCS) will not impact SIS functionality." Historically, SIS designs were "stand-alone, physically and logically separated, and air-gapped from the rest of the control system." Some modern designs, called Integrated Control and Safety Systems, allow the safety system to communicate with the control system; even then, NIST notes, the SIS "must still comply with the requirements" of the process safety standard IEC 61511. NIST says an SIS "is typically found in chemical, refinery, and nuclear processes."²⁵

The separation matters. If an attacker can change both the control system and the safety system that is supposed to catch the control system's mistakes, the plant has lost its last automated protection. That is exactly what the Triton malware tried to do in 2017: according to the Justice Department, it was designed to keep the safety system from working while the plant appeared normal, and a fault in it led the refinery's safety systems "to initiate two automatic emergency shutdowns" instead.²⁶ Lesson 5 covers how safety and security teams work together.

A walk-through: one made-up Idaho line

Parts make more sense in motion. Picture a small, made-up potato processing plant in the Magic Valley. (It is a teaching example, not a real company.) One step on its line is a blancher: a long tank of hot water with a conveyor that carries cut potatoes through it for a set time before they go on to the next step. Here is what each part of the control system does during one shift.

1. The PLC holds the temperature. A temperature sensor in the tank reports the water temperature many times a second. The PLC compares it with the set point and opens or closes the steam control valve a little at a time. A level sensor tells it when to add water. A drive controls the conveyor motor so potatoes spend the right amount of time in the water. All of this is Level 0 (the sensors, valve and motor) and Level 1 (the PLC).
2. The operator watches the HMI. A touchscreen beside the line (Level 2) shows the tank, the temperature, the conveyor speed and any alarms. When the product changes (a different cut, a different customer), the operator changes the set point on the screen, and the HMI sends the new value to the PLC.
3. The historian records everything. A server in the plant's control room (Level 3) collects the temperature, valve position and conveyor speed every few seconds and stores them. If a customer asks whether a lot was processed correctly, quality staff pull the record.
4. The business side sees totals. The plant's ERP system on the corporate network (Level 4) needs to know how many pounds went through each shift. It gets those numbers from a copy of historian data placed in the industrial DMZ, so office users never connect into the plant network itself.
5. The controls engineer changes the program, rarely and on purpose. When the plant adds a new product, a controls engineer uses the engineering workstation (Level 3) to change the PLC program, during a planned stop, following the plant's change process. The rest of the time, that workstation should have no path to the PLC at all, or a path that is switched on only when needed.
6. The boiler protects itself. The steam comes from a boiler with its own burner and safety controls, separate from the blancher PLC. If the boiler's pressure or flame goes wrong, those controls shut it down no matter what the blancher PLC is doing. In a chemical plant or refinery, the equivalent protection would be a formal safety instrumented system.

Now imagine three bad days at this plant. In the first, ransomware encrypts the office network and the ERP system. The blancher keeps running, but the plant cannot print shipping labels or see orders, so management stops the line anyway. In the second, someone gets onto the engineering workstation and changes the PLC program so the water runs too cool, while the HMI still shows the normal number. Product is under-processed and nobody notices until a customer complaint. In the third, a remote support link left open for a vendor is found by an outsider, who turns the conveyor off and changes the set point on the screen. All three have happened, in different forms, at real plants. Lesson 3, threats and real cases, goes through the documented ones.

A second example: the water system behind the plant

Many Idaho plants also run their own water and wastewater systems: wells and pumps that supply process water, treatment for wash water, and pretreatment before discharge to a city sewer or a permitted outfall. Small towns run the same kind of systems for drinking water. The control picture is the same in miniature. A chemical feed pump (an actuator) adds a disinfectant in proportion to flow measured by a flow meter (a sensor). A PLC or RTU at the pump house runs the logic. A SCADA screen in the office or on an operator's phone shows tank levels and alarms. Pumps at distant wells report over radio or cellular modems.

Those remote links are where water systems have been hurt. In November 2023, the Municipal Water Authority of Aliquippa, Pennsylvania, found a booster station controller disabled by attackers and switched to manual operation; its chairman said, "It sent an alarm and we took control manually," and "Nobody was ever at risk."²⁷ In July 2026, CISA said attackers went after more than 100 internet-exposed U.S. water and wastewater systems; in Minnesota, the city of Plymouth disconnected cellular-connected equipment at two water towers and lift stations and ran them manually.²⁸²⁹ The ability to run by hand saved the day in both cases, which is why CISA lists "Practice and maintain the ability to operate OT systems manually" among its five primary OT mitigations.²⁰

IT/OT convergence, the Industrial Internet of Things and the cloud

Why plants connected

Plants were not connected to business networks by accident. Owners wanted production numbers in the ERP system without retyping them. Engineers wanted to fix a line at 2 a.m. from home instead of driving in. Vendors wanted to watch their machines for early signs of failure. Corporate wanted one network, one set of accounts and one help desk. NIST describes the result: "due to the need for business agility and cost reduction for OT infrastructures, OT systems and networks are becoming more integrated into business networks and cloud infrastructures."³⁰ Each connection brought a real benefit. Each also gave an attacker on the business side a possible path down to the controllers.

This is what people mean by IT/OT convergence: plant systems now use the same computers, operating systems, network gear and often the same accounts as the office, and are connected to the office, while still running physical processes with OT's priorities. Convergence is not good or bad in itself. It is the condition every plant security program now starts from.

What the Industrial Internet of Things means

NIST describes the Industrial Internet of Things (IIoT) as "sensors, instruments, machines, and other devices that are networked together and use internet connectivity to enhance industrial and manufacturing business processes and applications." It adds a sentence worth remembering: "As IT and OT systems continue to converge and become even more interconnected, the control of physical processes remains a relatively unique and critical concept of OT."³⁰

Examples in an Idaho plant: wireless vibration sensors on motors that send data to a maintenance service; a vendor's "connected" packaging machine that reports its status to the manufacturer; energy meters that report to a utility program; a refrigeration system the contractor watches from its office. NIST describes a three-tier IIoT model from the Industry IoT Consortium: an edge tier that collects data from devices, a platform tier that processes it and forwards commands, and an enterprise tier of business applications. The platform tier, NIST notes, can sit "in an on-site data center, an off-site data center, or in the cloud," and the link between edge and platform may be "a corporate network or an overlay private network over the public internet or a 4G/5G network."³⁰

Cloud and edge

That last phrase is the security problem in a nutshell. A cellular modem inside a machine cabinet can connect a controller straight to the internet without ever touching the plant firewall. NIST notes that IIoT "can increase connectivity and information exchanges with enterprise systems and cloud-based systems, which may require additional considerations for the security architecture."²² It also warns that cloud services used to support OT "may have additional availability challenges resulting from increased sensitivity to system performance levels or connection issues."³⁰ If the cloud service or the internet link goes down, does the line stop? Plants should know the answer before they buy.

NIST's own example architecture for a plant with IIoT devices puts them on separate network segments and routes "Communication from the IIoT platform tier" through the DMZ border firewall, so security services in the DMZ can monitor it.²² The idea is simple: new connected gear is fine, as long as it goes through a door you control and watch.

What convergence changed for security

Three things changed. First, attackers no longer need special plant knowledge to reach a plant: ordinary ransomware that spreads through Windows networks can reach the Windows computers that run HMIs and historians. Second, plant systems now inherit IT's weaknesses (phishing, stolen passwords, unpatched remote access gear) while keeping OT's inability to patch quickly. Third, the people responsible are split: IT knows the threats, engineering knows the process, and the gap between them is where many incidents happen. The rest of this module is about closing that gap.

The Purdue model

Ask a plant security person to draw a factory and you will almost always get the same picture: a stack of horizontal layers, with the physical process at the bottom, business systems near the top, and a buffer zone in the middle. That picture is the Purdue model. It is the most common shared map in industrial security, and the rest of this module uses its level numbers. It is also older than most of the people who use it, was not built for security, and does not fit every modern plant. This section covers all of that.

Who made it and when

The model comes from Purdue University in West Lafayette, Indiana, and from one engineer in particular. Theodore J. Williams (1923 to 2013) was professor emeritus of engineering and director emeritus of the Purdue Laboratory for Applied Industrial Control, where he served from 1965 through 1994. According to the biography kept by the PERA project, he "guided and edited the original development of both the Purdue Reference Model for CIM" and the Purdue Enterprise Reference Architecture. He was also the 1969 president of the Instrument Society of America, the organization now called the International Society of Automation (ISA).³¹

Two documents carry the name, and they are often blurred together:

• The Purdue Reference Model for CIM (1989). CIM stands for computer integrated manufacturing, the 1980s goal of tying a plant's control computers to its planning and business computers. NIST's guide cites the model as "Williams TJ (1989) A Reference Model For Computer Integrated Manufacturing (CIM). (Instrument Society of America, Research Triangle Park, NC)."³
• The Purdue Enterprise Reference Architecture, or PERA (December 1991). PERA came out of the Industry-Purdue University Consortium for Computer Integrated Manufacturing, a group of ten process industry, control and computer companies chartered to work together from 1989 to 1992. Its key report, "The Purdue Enterprise Reference Architecture," was Technical Report 154, dated December 1991, and the Instrument Society of America published a version in 1992.⁴ NIST likewise says PERA was "first published by ISA in 1992."³ Williams also described it in the journal Computers in Industry in 1994.³²

So "late 1980s and early 1990s" is the accurate short answer for when the Purdue model was created. Neither document was a cybersecurity design. They were models of how to organize information and control in a manufacturing enterprise. Security people adopted the levels later because they made a convenient way to decide which systems should talk to which.

The levels, one by one

ISA describes its ISA-95 standard (also published as ANSI/ISA-95 and adopted internationally as IEC 62264) with five levels, 0 to 4, and says ISA-95 was "established in the mid-1990s."³³ The PERA project says ISA-95 was "based on parts of the PERA Reference Model for CIM," and that Williams and his colleague Gary Rathwell were early members of the ISA-95 committee.³¹ Security practice then added a Level 5 on top and an industrial DMZ between Levels 3 and 4.

Levels and names from ISA's ISA-95 page; time scales for Levels 3 and 4 from the Wikipedia summary of ISA-95; the seconds-and-less entries are this lesson's plain description.³³³² Notice the disagreement in the Level 1 and 2 rows. ISA's own summary places PLCs and DCS at Level 2, "Monitoring and supervising control," while many security diagrams, NIST's examples and the drawing below put controllers at Level 1 and operator screens at Level 2. A Tripwire analysis notes that level numbering varies by vendor.³⁴ When two people argue about whether a device is "Level 1" or "Level 2," check that they are using the same chart. What matters for security is not the number but which systems are allowed to talk to which.

The industrial DMZ, and why "Level 3.5" is informal

A demilitarized zone (DMZ) is a small network that sits between two others, so that neither has to connect directly to the other. NIST's glossary defines it in firewall terms: "An interface on a routing firewall that is similar to the interfaces found on the firewall's protected side," with traffic between the DMZ and other protected interfaces still passing through the firewall.¹³ In a plant, the DMZ holds the systems that both sides need: a copy of historian data that business users can read, servers that stage software patches and antivirus updates before they go into the plant, and the remote access "jump host" that outside support people must pass through.

NIST's example architecture describes the rule: "Any communications between the enterprise level and the operations management level are required to go through services within the DMZ." It adds a warning: "Since the DMZ connects to outside environments, the services within the DMZ must be monitored and protected to avoid compromises that allow attackers to pivot to the OT environment without detection." The same example shows a separate authentication server for OT users in the plant network, apart from the IT one, which NIST suggests organizations consider "if it supports their risk-based security objectives."²²

Many people call the DMZ "Level 3.5," because it sits between Level 3 and Level 4. That label is useful shorthand, but it is informal. NIST's guide refers to "Purdue model Levels 3, 4, 5, and the OT DMZ," not to a Level 3.5, and this module's fact checkers found no official standard that uses the number.⁵ If a vendor proposal or an audit finding talks about "Level 3.5," it means the industrial DMZ.

Some plants go a step further at the boundary with a unidirectional gateway (sometimes called a data diode). NIST defines it as hardware and software where "The hardware permits data to flow from one network to another but is physically unable to send any information at all back to the source network."¹³ Data can leave the plant for business reporting, but nothing can come back in that way. It is strong protection with a real cost: anything that needs to flow into the plant (patches, recipe changes, remote support) needs another, controlled path.

ISA-95 and the Purdue levels

ISA-95 is not a security standard. It is the standard for connecting plant systems to business systems: what information an ERP system and a manufacturing execution system exchange about orders, materials, production and quality. It uses the Purdue levels to say where each function lives. NIST describes the ISA95 committee as defining "the interface between control functions and other enterprise functions based upon the Purdue Reference Model for Computer Integrated Manufacturing (CIM)," and says "The ISA95 standard grew from the Purdue Enterprise Reference Architecture (PERA)." Since then, NIST says, it "has served as a common reference for defining the interfaces between the enterprise and control networks across all OT sectors."³ That is why security people inherited its levels: the line ISA-95 draws between Level 3 and Level 4 is exactly where most plants want their strongest security boundary.

How NIST SP 800-82 Rev. 3 uses Purdue

NIST treats Purdue as one useful option, not a requirement. In its section on network architecture, NIST recommends that organizations "characterize, segment, and isolate IT and OT devices," and says they "may also consider using an industry-recognized model to organize their OT network segmentation, such as the Purdue model [Williams], ISA-95 levels [IEC62264], the three-tier IIoT system architecture [IIRA19], or a combination of these models." Its Figure 16 is a "High-level example of the Purdue model and IIoT model for network segmentation with DMZ segments."⁵

NIST's firewall guidance is where the levels earn their keep: "Firewall rulesets should be established to only permit connections between adjacent levels, tiers, or zones. For example, organizations that utilize a Purdue model architecture should implement firewall rules and connection paths that prevent Level 4 devices from directly communicating with Level 2, 1, or 0 devices. A similar concept would be applied to ISA/IEC 62443 and IIC architectures." NIST also notes that outbound traffic from the control network is an area "of considerable variation in practice," and that organizations "should consider making outbound rules as stringent as inbound rules."⁵ Outbound rules matter because much malware, once inside, calls out to its controller on the internet.

NIST connects Purdue to newer ideas too. On zero trust (the approach of checking every user and device on every connection rather than trusting anything inside the network), NIST says many OT components may not support it, so organizations can apply it to compatible devices "typically found at the functionally higher levels of the OT architecture (e.g., Purdue model Levels 3, 4, 5, and the OT DMZ)."⁵ On remote access, NIST notes that "Many OT security architectures are designed with multiple levels, such as in the Purdue model. This can significantly limit access, which can minimize accidental or unauthorized disruptions to operations."⁵ How NIST's guide is organized, and how it compares with ISA/IEC 62443, is the subject of lesson 2, IEC 62443 and NIST SP 800-82.

How ISA/IEC 62443 moves beyond levels: zones and conduits

The ISA/IEC 62443 series, the main international standards for securing industrial automation and control systems, came out of ISA's ISA99 committee, which ISA "established in 2002."³⁵ The series does not organize security around Purdue levels. Its organizing idea is the zone, a "grouping of logical or physical assets based upon risk or other criteria," and the conduit, a "logical grouping of communication channels that share common security requirements connecting two or more zones." The ISA Global Cybersecurity Alliance's free quick start guide to the series explains zones and conduits and does not mention the Purdue model at all.⁶

The difference is practical. Purdue sorts equipment by function: everything that supervises goes in Level 2. Zones sort equipment by risk: the safety system gets its own zone even though it sits at the same "level" as the control system; a packaging line built by one integrator and a mixing line built by another can be separate zones; a vendor's remote connection is a conduit with its own rules. A plant can, and many do, use both: Purdue to explain the picture to management and zones and conduits to design the actual firewall rules.

Government guidance has moved the same way. CISA's August 2025 asset inventory guide says there are "multiple models and standards to organize assets," that the choice is "at the discretion of the organization," and it built its sample inventories using 62443 zones and conduits.³⁶ In April 2026, CISA and federal partners released "Adapting Zero Trust Principles to Operational Technology," which centers on zones and conduits along with supply chain, identity, legacy systems and safety.³⁷ Lesson 2 explains the 62443 series in detail; lesson 7, a plant-floor segmentation plan, uses zones and conduits to build a worked example.

Criticisms of Purdue

The model has critics, and their points deserve a fair hearing.

• It was never a security design. A Tripwire analysis summarizes the complaint: the model was introduced "over 30 years ago," and "neither ISA95 nor the Purdue Model were originally intended as security architectures."³⁴
• Real plants are flatter than the drawing. Many plants have one network where office PCs, HMIs and PLCs all sit together. Dragos, an industrial security company, reported that 81 percent of its 2025 assessments found poor segmentation between IT and OT.⁷ A Purdue diagram on the wall does not mean Purdue boundaries exist on the wire.
• The cloud skips levels. An IIoT sensor that sends data straight to a vendor's cloud platform, and a cloud application that sends commands back, do not fit a stack where every connection passes through each layer in turn. Tripwire notes that software-defined networking, IIoT and edge-to-cloud designs have led "some people" to ask "whether the Purdue Model is dead."³⁴ NIST's September 2026 draft Rev. 4 expands its coverage of "Industrial Internet of Things (IIoT) and cloud convergence," a sign that the old picture needs updating.¹²
• Wireless and cellular links ignore the stack. A cellular modem in a pump house or a machine cabinet connects Level 1 equipment directly to a public network. NIST's IIoT description includes 4G and 5G links between edge devices and platforms.³⁰ In the July 2026 Minnesota water attacks, one city responded by disconnecting cellular-connected equipment at water towers and lift stations.²⁹
• Remote access tunnels through it. A virtual private network (VPN) or remote desktop session can place an outside user directly at Level 2 or 3, bypassing everything above. Dragos says "73 percent of all-time IR cases involved compromised VPN or jumphost credentials."⁷ In the December 2015 attacks on three Ukrainian power distribution companies, CISA reported that breakers were operated remotely using existing remote administration tools or ICS client software "via virtual private network (VPN) connections," with credentials likely stolen beforehand.³⁸

So is Purdue dead?

No, but it is not enough by itself. The same Tripwire analysis that collects the criticisms also defends keeping an industrial DMZ: most ICS threats arrive through IT, a DMZ slows an attacker's movement from one network to another, and plant traffic through it is predictable enough to allowlist (permit only known, expected connections).³⁴ NIST still uses the levels for firewall rules and zero trust. The fair summary is this: use Purdue as a shared vocabulary and a starting map; use zones and conduits to design real boundaries based on risk; then check the map against reality, because cellular modems, vendor links, cloud services and flat networks are where real attacks come in. Lesson 7 shows how to do that, step by step.

The OT threat picture, in brief

Lesson 3, threats and real cases, tells the documented stories in detail: Colonial Pipeline, NotPetya, the Ukrainian grid, Triton, the 2023 and 2026 controller attacks and more. This section gives only the outline you need to make sense of the architecture above.

Most incidents start in IT

The attacks that have stopped the most factories did not begin with exotic plant malware. They began with ordinary intrusions into business networks, and the plant stopped either because the infection spread to Windows machines on the plant floor or because the company could not safely run without its business systems.

• Colonial Pipeline, May 2021. CEO Joseph Blount told a Senate committee that "that attack encrypted our IT systems" and that the company believed the attacker "exploited the legacy VPN profile that was not intended to be in use." Asked whether the attack was detected only on the IT network, not the OT network, he answered, "Senator, that is correct." The company shut the pipeline anyway, he said, because "if there was one percent chance that that OT system was compromised, it was worth shutting the pipeline system down."³⁹
• Norsk Hydro, March 2019. The aluminum maker says the attack "affected our entire global organization" and forced units onto "work-intensive workarounds and manual procedures," with a total financial impact it estimates at about NOK 800 million.⁴⁰
• Jaguar Land Rover, September 2025. After a cyber incident announced Sept. 2, 2025, the automaker said "manufacturing restarted on a phased basis from 8 October 2025," and it reported costs of GBP 196 million "relating to the cyber incident" in its quarterly results.⁴¹
• Fairlife, July 2026. Coca-Cola disclosed in a July 16, 2026, SEC filing that a ransomware attack led it to suspend production at its Fairlife dairy unit's U.S. facilities, according to Cybersecurity Dive.⁴²

The data agree. In its 2025 Data Breach Investigations Report, Verizon found that in manufacturing breaches, "Hacking via the Use of stolen credentials shows up in more than one-third (34%)," ransomware in 47 percent, exploited vulnerabilities in 23 percent and phishing in 19 percent. The "System Intrusion" pattern accounted for 60 percent of manufacturing breaches.⁴³ IBM X-Force's 2026 Threat Intelligence Index, as reported by Manufacturing Dive, found that exploiting public-facing applications was the most common way attackers breached manufacturing systems (32 percent of observed cases), followed by valid accounts (16 percent) and external remote services (11 percent).⁸ Every one of those is an IT doorway. The architecture in this lesson exists to make sure that walking through an IT door does not lead straight to a controller.

What the industry reports say about volume

Manufacturing is now the most targeted industry in several major reports. IBM X-Force said manufacturing accounted for 27.7 percent of the cyberattacks in its 2025 data, the fifth straight year manufacturing ranked first.⁸ Verizon counted 3,837 incidents in manufacturing in its 2025 report, 1,607 with confirmed data disclosure, up from 849 confirmed breaches the year before. It also noted that "more than 90% of breached organizations were SMBs with fewer than 1,000 employees," and that espionage was the motive in about 20 percent of manufacturing breaches, compared with 3 percent the year before, a jump Verizon says is "most likely due to changes in our contributors' datasets."⁴³

Dragos, which specializes in industrial systems, said in February 2026 that 119 ransomware groups hit about 3,300 industrial organizations in 2025, up from 80 groups in 2024, and that manufacturing made up "more than two-thirds" of ransomware victims. Its chief executive, Robert M. Lee, said "industrial organizations significantly underestimate the reach of ransomware into OT environments."⁴⁴ The same report found that 30 percent of its incident response cases began as unexplained operational problems, not as security alerts, and that only 46 percent of the sites it assessed had adequate OT network monitoring.⁷ A later Dragos quarterly count, reported by Help Net Security, tallied 1,140 ransomware incidents affecting industrial organizations in the second quarter of 2026, with 747 in manufacturing (about 65 percent) and 431 in the United States.⁴⁵

The FBI's Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints in 2025, and it said the top 10 reported ransomware variants "most impacted the following Critical Sectors: Critical Manufacturing, Healthcare and Public Health, and Government Facilities."⁴⁶ Keep in mind that IC3 counts only what victims report, and that company reports like Dragos's and IBM's reflect their own customers. Each number is a window, not the whole house.

Direct attacks on controllers exposed to the internet

A second kind of attack skips the business network entirely: someone finds a controller or HMI reachable from the internet and logs in. Federal agencies warned in December 2023 that actors tied to Iran's Islamic Revolutionary Guard Corps, using the name "CyberAv3ngers," had compromised Israeli-made Unitronics controllers "Since at least November 22, 2023," using default credentials, with victims in multiple U.S. states. The agencies' advice included "Check PLCs for default passwords."⁴⁷

In 2026 the problem grew. CISA advisory AA26-097A, first issued April 7, 2026, and updated July 22, 2026, said Iranian-affiliated actors "disrupted PLCs across several U.S. critical infrastructure sectors," and the July update widened the warning from one vendor's devices to "potentially all internet exposed PLCs." Among its key actions: "Remove PLCs from direct internet exposure via secure gateway and firewall."²³ CISA later said it saw attacks on more than 100 internet-exposed U.S. water and wastewater systems in July 2026.²⁸ A January 2025 joint guide for OT buyers explains why these attacks spread so widely: threat actors "target specific OT products rather than specific organizations."⁴⁸ If your plant uses an exposed model, you are on the list whether anyone has heard of your company or not.

Patient intruders and plant-specific attacks

A third kind is rarer and more dangerous: state-backed operators who study a target and wait. In February 2024, U.S. agencies said Chinese state-sponsored actors known as Volt Typhoon were "seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States," that they assessed "with high confidence" the actors were positioning to move to OT assets, and that in some victims the access had lasted "for at least five years."⁴⁹ Stuxnet, first reported in June 2010, attacked a Windows application used with a Siemens industrial control system; the Congressional Research Service quoted the head of Europe's cybersecurity agency calling it "really a paradigm shift."⁵⁰ Triton, in 2017, went after a refinery's safety system.²⁶

MITRE, the nonprofit that maintains a widely used catalog of attacker behavior, released ATT&CK for ICS in January 2020. Its current matrix lists 12 tactics, including two built around industrial processes: "Inhibit Response Function" (stopping safety and protection functions from working) and "Impair Process Control" (making the process do the wrong thing).⁵¹ Those two categories are the reason OT security is not just IT security in a hard hat.

The flood of published weaknesses adds pressure. CISA publishes industrial control system advisories several times a week; one analysis counted "over 450 advisories published in 2025," with critical manufacturing technologies the largest share (45.8 percent) of affected technologies.⁵² Most entries in CISA's Known Exploited Vulnerabilities catalog are IT and network-edge products, not plant controllers; this module's fact check found only a handful of entries for major OT vendors in the Oct. 27, 2026, catalog.⁵³ That is consistent with everything above: attackers usually reach OT through IT.

What government tells owners to do first

In May 2025, CISA, the FBI, the EPA and the Department of Energy published a short fact sheet (two pages of guidance plus a page of resources), "Primary Mitigations to Reduce Cyber Threats to Operational Technology." It names five steps:²⁰

1. "Remove OT connections to the public internet." The agencies say attackers find exposed devices "by searching for open ports on public IP ranges with search engine tools."
2. "Change default passwords immediately and use strong, unique passwords."
3. "Secure remote access to OT networks": if remote access is essential, use a private network connection and a VPN with "phishing-resistant multifactor authentication (MFA)," least privilege, and disabled dormant accounts.
4. "Segment IT and OT networks," including "introducing a demilitarized zone for passing control data to enterprise logistics."
5. "Practice and maintain the ability to operate OT systems manually."

Every one of those steps touches running equipment. Plan each change with the equipment vendor, your safety lead and qualified controls and process safety engineers, follow your management-of-change process, and test it during a planned outage or on a test system first. The business-side layers that support these steps (accounts, multifactor sign-in, email security, backups) are covered in Layered Defense Architecture, and the business frameworks (NIST CSF 2.0, CIS Controls, ISO 27001) in Security Frameworks and Standards.

Who is affected in Idaho

Manufacturing jobs

Idaho had 77,500 manufacturing jobs in September 2026 (seasonally adjusted, preliminary), up from 74,900 a year earlier, out of 890,100 total nonfarm jobs, according to the Bureau of Labor Statistics. That makes manufacturing about 8.7 percent of Idaho's nonfarm jobs (this lesson's calculation from the BLS figures).⁹ Every one of those jobs depends on equipment that runs on the kind of systems this lesson describes, from a semiconductor fab to a sawmill to a cheese plant.

Major manufacturers

Manufacturers on the Idaho Department of Labor's list of the state's 15 largest private employers for 2025 include Micron Technology at No. 5 (5,000 to 7,499 average employees), J.R. Simplot Co. at No. 7 (2,500 to 4,999) and Amalgamated Sugar Company at No. 12 (1,000 to 2,499).¹⁰ Between them they cover three very different kinds of OT: semiconductor fabrication, food and agricultural processing, and a seasonal sugar-beet process. Beyond them are hundreds of smaller manufacturers, food processors, dairies, sawmills, machine shops and defense suppliers, plus the city water systems, irrigation districts and utilities they all depend on. Verizon's finding that more than 90 percent of breached manufacturers had fewer than 1,000 employees is a reminder that small does not mean safe.⁴³

Idaho National Laboratory

Idaho has an unusual asset: Idaho National Laboratory (INL) in Idaho Falls, one of the country's main centers for control system security research and training.

• The Aurora test (2007). On March 4, 2007, a test at INL showed that remote commands could physically damage a 2.25-megawatt generator; CNN aired the video that September, and DHS later released hundreds of pages of documents about it under a public records request. It became the standard example of a cyberattack causing physical damage.⁵⁴
• Training. CISA's advanced ICS course, ICS301, is a four-day, in-person course at "a facility in Idaho Falls, Idaho"; CISA says "There is no tuition cost to attend this training," and the course includes a red team versus blue team exercise. The prerequisite is CISA's online ICS300 course, passed with "80% or better."¹¹ INL says the 301 course has "hosted more than 200 sessions."⁵⁵
• Methods. INL developed Consequence-driven Cyber-informed Engineering (CCE), which starts from the assumption that a skilled, determined adversary "can and will" get into the network and works backward from the worst consequences.⁵⁶ The Department of Energy's 2022 National Cyber-Informed Engineering Strategy builds on that idea of designing security into the engineering itself.⁵⁷ Lesson 5 explains both.
• Free tools. NIST's manufacturing extension program points small manufacturers to "Malcolm," a network traffic analysis tool suite from INL and CISA with parsers for many industrial protocols.⁵⁸ INL also hosts CyTRICS, a Department of Energy program for testing control system components.⁵⁹

Help for small Idaho manufacturers

The federal Manufacturing Extension Partnership (MEP), run by NIST and "initially authorized in 1988," has state-designated centers across the U.S. and in Puerto Rico and "more than 450 MEP service locations."⁵⁸ Idaho's is TechHelp, which Boise State University calls "Idaho's official Manufacturing Extension Partnership Center," based at Boise State with Idaho State University, the University of Idaho and the Idaho Manufacturing Alliance as partners. On March 25, 2026, Boise State announced that NIST had awarded TechHelp a new cooperative agreement to keep serving manufacturers.⁶⁰ NIST says MEP centers can help manufacturers "assess your business's current risk posture, identify any gaps, and implement solutions."⁵⁸ This module could not confirm which cybersecurity services TechHelp offers today, so ask TechHelp directly.

What is not on the record in Idaho

This module's research found no publicly documented control system incident at an Idaho manufacturer or utility. An Idaho Statesman report in September 2026 quoted State Rep. Ted Hill, R-Eagle: "Idaho systems weren't targeted in this summer's attacks, but they could be next time." The report described a state cyber operations center in Boise with four full-time employees plus part-time staff, aiming for "fully manned, 24/7 operations" by June 2027. Hill also told the paper, "We are extremely vulnerable."⁶¹ Absence of a public report is not proof that nothing has happened: most private companies have no duty to announce a plant-floor incident unless it triggers a specific rule (lesson 6, sector rules, explains which ones).

Where this module goes next

This lesson gave you the vocabulary and the map. The other six lessons use them:

• Lesson 2: IEC 62443 and NIST SP 800-82, the two main guides, how they are organized, what security levels and the OT overlay mean, and what the 2026 drafts change.
• Lesson 3: threats and real cases, the documented attacks in detail and what each one teaches.
• Lesson 4: remote access, vendors and the supply chain, how outside help gets in, and how to control it.
• Lesson 5: patching and safety together, keeping systems current without stopping production, and keeping safety and security teams working as one.
• Lesson 6: sector rules, NERC CIP, TSA pipeline directives, CMMC, FDA, water and the other rules that do apply to some plants.
• Lesson 7: a plant-floor segmentation plan, a worked example that turns the Purdue map into zones, conduits and firewall rules, step by step.

Common mistakes

Each of these has a documented case behind it.

1. Believing the plant is isolated because it was designed that way. Dragos found poor IT/OT segmentation in 81 percent of its 2025 assessments.⁷ The original drawing may show a clean boundary; years of added connections may have erased it. Check the actual network, not the diagram.
2. Leaving controllers reachable from the internet with factory passwords. The 2023 Unitronics defacements used default credentials, and one of the 2026 advisory's key actions was to remove PLCs from direct internet exposure.⁴⁷²³
3. Forgetting old remote access accounts. Colonial Pipeline's CEO said the attacker used a "legacy VPN profile that was not intended to be in use," and that it "did only have single-factor authentication."³⁹ Every unused remote account is an open side door.
4. Assuming an office attack cannot stop the plant. Colonial, Norsk Hydro, Jaguar Land Rover and Fairlife all lost production after attacks that began on business systems.^39404142 Plan for the day the ERP system, the label printers or the email are gone.
5. Bringing IT habits straight to the plant floor. NIST warns that rebooting, a routine IT fix, is "usually not acceptable for OT," and that "Indiscriminate use of IT security practices in OT may cause availability and timing disruptions."² An aggressive network scan or an automatic patch on a control system can stop a line.
6. Installing security software the vendor has not approved. NIST notes that "service support can be lost if third-party applications are installed without vendor acknowledgement or approval."² Get the vendor's written approval first.
7. Letting the safety system and its engineering workstation sit on ordinary networks. After Triton, CISA advised keeping safety controller key switches out of program mode except when needed, and keeping safety systems on isolated networks.²⁴
8. Losing the ability to run by hand. When attackers disabled a booster station controller in Aliquippa, Pa., in 2023, operators "took control manually."²⁷ CISA lists manual operation as one of its five primary mitigations.²⁰ Plants that have automated away every manual skill have nothing to fall back on.
9. Not knowing what you have. CISA's 2025 guide defines an asset inventory as "an organized, regularly updated list of an organization's systems, hardware, and software," built from "a physical inspection and logical survey."³⁶ You cannot segment, patch or watch equipment you do not know is there, including the cellular modem a contractor installed in a panel.

Questions people ask

Is OT the same thing as ICS?

Nearly. Industrial control systems (SCADA, DCS and PLC-based systems) are the core of OT. NIST's 2023 guide widened the term to include building automation, transportation, physical access control and environmental monitoring systems, which is why its title changed from "Industrial Control Systems (ICS) Security" to "Operational Technology (OT) Security."¹ For a factory, the two words mean about the same thing.

We are a 40-person machine shop. Do we even have OT?

Almost certainly. A computer numerical control (CNC) machine, a programmable controller on a paint booth or compressor, a building's heating controls, a networked label printer on the shipping line, and the laptop a technician uses to load programs are all OT or connect to it. The questions are the same at any size: what is connected, who can reach it, and can you keep working if it is locked up. NIST says PLCs often serve as "the primary controller in smaller OT system configurations."²¹ Small size does not lower the risk: Verizon found that more than 90 percent of breached manufacturers had fewer than 1,000 employees.⁴³ Free help starts with Idaho's MEP center and CISA's free services, listed in "Where to go next" below.

Do we have to follow the Purdue model?

No law requires it. NIST presents it as one industry model an organization "may also consider," alongside ISA-95 levels, the three-tier IIoT architecture "or a combination of these models."⁵ CISA says how to organize assets is "at the discretion of the organization."³⁶ Some regulated sectors have their own required structures (lesson 6 covers them). What every guide does expect is some deliberate separation between business and plant networks, with controlled, monitored paths between them.

What is "Level 3.5"?

It is a common nickname for the industrial DMZ, the buffer network between the plant (Level 3 and below) and the business network (Level 4). It is not an official level in ISA-95 or in NIST's guide, which refers to "the OT DMZ."⁵ If someone says "Level 3.5," ask what is actually in their DMZ and what rules govern traffic through it.

Can't we just unplug the plant from everything?

Some plants can isolate their most critical systems, and in July 2026 CISA and Australian partners said "physical isolation remains the most risk-effective solution" when vital systems face state-sponsored threats.⁶² But a true air gap (no network connection at all) is hard to keep. Data still has to move in and out by laptop or USB drive, vendors still need to support equipment, and production numbers still need to reach the business. Many "air-gapped" plants turn out to have a forgotten connection. The practical goal for most plants is to be able to isolate quickly when needed, and to keep the connections they do have few, known, controlled and watched. The hard question below goes further.

Who should be in charge of plant cybersecurity, IT or engineering?

Both, with one named leader and clear rules. NIST says control networks "are typically managed by control engineers rather than IT personnel," and that changes to OT require "careful assessment by OT experts (e.g., control engineers) working in conjunction with security and IT personnel."² A workable split: engineering decides what is safe to change on the plant floor and when; IT brings threat knowledge, account management and monitoring; neither side changes the other's systems alone. Lesson 2 describes NIST's advice on building that cross-functional team.

Our equipment vendor wants to monitor our machines from its cloud. Does that break the model?

It breaks the simple picture, not necessarily your security. NIST's example for IIoT routes communication from the IIoT platform through the DMZ border firewall so it can be monitored, instead of letting devices reach the internet on their own.²² Before agreeing, ask the vendor how the connection is made (through your firewall or through its own cellular modem), whether it can send commands or only read data, how its own access is protected, and what happens to the machine if the cloud link fails. Lesson 4 covers vendor access in detail.

Why can't we patch the plant the way IT patches laptops?

Because NIST says OT updates "need to be thoroughly tested by both the vendor and the end user of the industrial control application before being implemented," outages must be planned "days or weeks in advance," and some systems need revalidation after a change. Many plant computers run operating systems their makers no longer patch at all.² Plants still reduce risk: by isolating what cannot be patched, by patching the IT-facing systems in the DMZ quickly, and by fixing exposed remote access first. Lesson 5 explains how.

Where can our people learn OT security without a big budget?

CISA offers free online ICS courses and the no-tuition ICS301 course in Idaho Falls.¹¹⁵⁵ The ISA Global Cybersecurity Alliance offers free introductory material on the 62443 series.³⁵ NIST's SP 800-82 guide is free to download.¹ Your equipment vendors and integrators may also offer training on their own products' security settings.

Hard questions

Should critical plants be cut off from outside networks?

The case for isolation. Every connection is a path an attacker can use, and the record shows they use them: stolen VPN and jump host credentials appear in 73 percent of Dragos's response cases over its history, and remote VPN access was how attackers operated breakers in Ukraine in 2015.⁷³⁸ Safety systems were historically built "stand-alone, physically and logically separated, and air-gapped" for good reason.²⁵ CISA and its Australian partners said in July 2026 that "physical isolation remains the most risk-effective solution" against state actors pre-positioning in critical infrastructure.⁶²

The case for managed connection. Plants connected because connection pays: faster repairs, less downtime, better quality data, vendor expertise without travel. A plant with no remote access may wait a day for a technician while a line sits idle. And isolation often fails quietly: data still moves by laptop and USB drive, and an unknown cellular modem defeats the whole idea. A carefully designed DMZ, with monitored and limited connections, may give more real protection than an "air gap" nobody checks.

What the evidence shows. The documented losses mostly came through connections that were unmanaged, forgotten or weakly protected (a legacy VPN profile with one password at Colonial, default passwords on exposed controllers in 2023 and 2026), not through well-designed, monitored ones.³⁹⁴⁷²³ The CI Fortify guidance itself centers on preparing to isolate (mapping dependencies, building separation points and testing graduated isolation plans) rather than on never connecting.⁶² Most plants can get most of the benefit of isolation by removing internet exposure, cutting unused connections, and being able to disconnect fast and run manually when needed.

Is the Purdue model still the right foundation?

Yes, say its defenders. It is a shared language that engineers, IT staff, auditors and vendors all understand. NIST still uses its levels for firewall and zero trust guidance.⁵ The industrial DMZ addresses the most common real-world path, from IT to OT, and plant traffic through it is predictable enough to lock down tightly.³⁴

No, say its critics. It was built for computer integrated manufacturing more than 30 years ago, was not "originally intended as security architectures," in Tripwire's words, and does not describe plants where sensors talk to the cloud, contractors connect by cellular modem and one flat network holds everything.³⁴ Teams that draw Purdue diagrams may believe they are segmented when they are not.

What the evidence shows. The standards bodies have moved toward risk-based zones and conduits (ISA/IEC 62443, and CISA's 2025 and 2026 guidance) while keeping Purdue as a reference.⁶³⁶³⁷ The biggest measured problem is not the model's age but the gap between model and reality: 81 percent of Dragos's assessments found poor IT/OT segmentation.⁷ Whichever model a plant uses, the test is whether the boundaries exist on the wire and are watched.

Should IT or engineering own OT security?

The case for IT. Attackers reach plants through IT doors (stolen credentials, exposed applications, remote services), and IT teams know those doors.⁴³⁸ Central security teams already run monitoring, identity and incident response, and plants rarely have security specialists of their own.

The case for engineering. NIST says control networks "are typically managed by control engineers" and that assuming the differences are insignificant "can have disastrous consequences."² A well-meant IT action (a scan, a reboot, an automatic update) can stop a line or defeat a safety function. Engineers know which changes are safe.

What the evidence shows. NIST, the 62443 series and CISA all assume a shared model: OT experts "working in conjunction with security and IT personnel."² The weak point in real incidents is often the handoff: a remote access account no one owned, a connection no one remembered. Whoever leads, someone has to own the boundary between IT and OT by name.

Should the government require baseline plant security for manufacturers in general?

The case for rules. Voluntary guidance has existed for years, yet poor segmentation remains the norm in Dragos's assessments.⁷ When a big manufacturer stops, the costs spread far beyond it: after the Jaguar Land Rover attack, the UK government announced a loan guarantee to back up to GBP 1.5 billion in private bank lending to support the automaker's supply chain, and the UK's Cyber Monitoring Centre estimated the economic cost at GBP 1.9 billion.⁶³⁶⁴ Colonial's shutdown showed how one company's IT failure can become a regional fuel problem.³⁹

The case against. Plants differ enormously, and a single rule risks either being too weak for a chemical plant or too costly for a machine shop. Strong voluntary standards already exist (ISA/IEC 62443, NIST SP 800-82), and free help is available from MEP centers and CISA. Regulators may lack OT expertise, and CISA itself lost staff in 2025 and 2026: a Cloud Security Alliance research note, citing press reports, said CISA went from about 3,300 employees in January 2025 to about 2,400 by late 2025.⁶⁵

What the evidence shows. This module found no federal rule that sets plant-floor security controls for manufacturers in general; the rules that exist are sector-specific (electric grid, pipelines, defense contracts, medical devices, some water and chemical facilities), and lesson 6 compares how well each has worked. The evidence that voluntary approaches have left gaps is strong; the evidence on which kind of rule would close them at acceptable cost is thinner and still debated.

Where to go next

• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security: The main U.S. government guide to plant security, free PDF from NIST. Read Section 2 for how OT works and Section 5 for network architecture; plant managers can start with the comparison of OT and IT in Section 2.4. Draft Rev. 4 is open for comment until Nov. 30, 2026.
• CISA industrial control systems training: Free online ICS courses and the four-day ICS301 course in Idaho Falls, with no tuition cost. For controls engineers, technicians and IT staff who support plants; the online ICS300 course is the prerequisite.
• CISA free cyber services and tools: Free vulnerability scanning of internet-facing systems and the Cyber Security Evaluation Tool (CSET), a desktop application for evaluating OT and IT. Useful for small manufacturers and utilities as a first outside check of what is exposed.
• NIST MEP, Cybersecurity Resources for Manufacturers: Where to Start: Free, plain guide for small and medium manufacturers, organized by the NIST Cybersecurity Framework functions, pointing to free tools such as CSET and the INL and CISA Malcolm network tool. Idaho manufacturers can also contact TechHelp, Idaho's MEP center.
• ISAGCA Quick Start Guide to ISA/IEC 62443: A free overview of the 62443 series (the standards themselves are sold). Explains zones and conduits, security levels and roles; a good first read before lesson 2.
• MITRE ATT&CK for ICS: A free public catalog of how attackers behave against industrial systems, organized by tactic. Useful for defenders and reporters who want to describe an incident in standard terms.
• Idaho National Laboratory, Industrial Control Systems Cybersecurity Training: INL's page on the control system security training it supports with CISA, including the Idaho Falls courses; useful background for Idaho employers and officials.

Still being checked (7 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The label 'Level 3.5' for the industrial DMZ was not found in NIST SP 800-82 Rev. 3 or any official standard checked; this lesson treats it as informal industry shorthand.
• T.J. Williams's 1994 article in Computers in Industry is cited from a secondary reference list; the journal itself was not read.
• The time scales given for Purdue Levels 3 and 4 come from Wikipedia's summary of ISA-95, not from the paid standard.
• Which cybersecurity services TechHelp, Idaho's MEP center, offers today could not be confirmed.
• Details of the 2007 Aurora generator test come from press reports summarized on Wikipedia, not from the DHS documents themselves.
• The IBM X-Force figures come from Manufacturing Dive's coverage; the IBM report was not read, and the article does not state the base for the 16 percent and 11 percent figures explicitly.
• The programmable logic controller photo has no author field on Wikimedia Commons; it is credited to the uploader.

Last verified October 28, 2026. General education, not legal, engineering, safety or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri, Suzanne Lightman and others, Guide to Operational Technology (OT) Security, NIST Special Publication 800-82 Revision 3 (National Institute of Standards and Technology, September 2023), Abstract, p. i, and "Note to Readers," p. ii (read Oct. 28, 2026). Read it online. ↩
2. NIST SP 800-82 Rev. 3, Section 2.4, "Comparing OT and IT System Security," pp. 28 to 31, including Table 1, "Summary of typical differences between IT and OT systems" (read Oct. 28, 2026). Read it online. ↩
3. NIST SP 800-82 Rev. 3, References, entry [Williams]: "Williams TJ (1989) A Reference Model For Computer Integrated Manufacturing (CIM). (Instrument Society of America, Research Triangle Park, NC)," p. 145; and Appendix D.1.5.1, "ISA95, Enterprise-Control System Integration," p. 190 (read Oct. 28, 2026). Read it online. ↩
4. G.A. Rathwell and T.J. Williams, "Use of the Purdue Enterprise Reference Architecture and Methodology in Industry," PERA project website, describing the Industry-Purdue University Consortium for CIM and Technical Report 154 (December 1991) (read Oct. 28, 2026). Read it online. ↩
5. NIST SP 800-82 Rev. 3, Section 5.2.3 (network architecture, firewalls and zero trust), pp. 71 to 75, including Figure 16, "High-level example of the Purdue model and IIoT model for network segmentation with DMZ segments," and Section 6.2.10, "Remote Access," pp. 122 to 123 (read Oct. 28, 2026). Read it online. ↩
6. ISA Global Cybersecurity Alliance, "Quick Start Guide: An Overview of ISA/IEC 62443 Standards," June 2020, definitions of zone and conduit (read Oct. 28, 2026). Read it online. ↩
7. Dragos, "Launched: 9th Annual Dragos OT Cybersecurity Year in Review," Feb. 17, 2026 (segmentation, monitoring, VPN and jump host credential, and incident response findings; vendor data) (read Oct. 28, 2026). Read it online. ↩
8. Manufacturing Dive, "Manufacturing sector saw most cyberattacks in 2025: IBM X-Force," Feb. 26, 2026, reporting the IBM X-Force Threat Intelligence Index 2026 (read Oct. 28, 2026). Read it online. ↩
9. U.S. Bureau of Labor Statistics, Current Employment Statistics, Idaho manufacturing (series SMS16000003000000001) and total nonfarm (SMS16000000000000001), seasonally adjusted, September 2025 and September 2026 (preliminary), pulled from the BLS Public Data API (read Oct. 28, 2026). Read it online. ↩
10. Idaho Department of Labor, "2025 Top 15 private Idaho businesses," business listings page, updated August 2026 (read Oct. 28, 2026). Read it online. ↩
11. Cybersecurity and Infrastructure Security Agency, "Advanced Cybersecurity for Industrial Control Systems (ICS301)," course page (read Oct. 28, 2026). Read it online. ↩
12. NIST, "Guide to Operational Technology (OT) Security: NIST Requests Comments on Draft SP 800-82r4," news release, Sept. 21, 2026 (comments through Nov. 30, 2026) (read Oct. 28, 2026). Read it online. ↩
13. NIST SP 800-82 Rev. 3, Appendix B, Glossary, pp. 160 to 168 (definitions of ICS, SCADA, DCS, PLC, RTU, HMI, data historian, SIS, control server, field device, DMZ and unidirectional gateway, several quoting the ISA dictionary, NIST IR 6859 and ANSI/ISA-84) (read Oct. 28, 2026). Read it online. ↩
14. IEC 62443-2-1:2024, Security for industrial automation and control systems, Part 2-1: Security program requirements for IACS asset owners, publication date Aug. 7, 2024, publisher abstract as listed by the NSAI Standards shop (the standard itself is sold, not free, and was not reproduced) (read Oct. 28, 2026). Read it online. ↩
15. Modbus Organization, "Frequently Asked Questions" (read Oct. 28, 2026). Read it online. ↩
16. NIST SP 800-82 Rev. 3, Sections 2.3 and 5.2.3 (pp. 19 and 74), Appendix A (p. 149), Appendix D.1.4 (p. 189, citing IEEE Std 1815-2012) and Appendix E.1.1 (p. 207), on Modbus, Fieldbus, DNP3 (IEEE 1815), CIP and OT-aware firewalls (read Oct. 28, 2026). Read it online. ↩
17. ODVA, "CIP Security," technology standards page (read Oct. 28, 2026). Read it online. ↩
18. PROFIBUS and PROFINET International, "The PROFINET security specification gets a fine polish," press release, Nov. 13, 2023 (read Oct. 28, 2026). Read it online. ↩
19. OPC Foundation, "Communication securisee selon IEC 62541 OPC UA" (OPC UA security overview, in French), May 2014 (read Oct. 28, 2026). Read it online. ↩
20. CISA, FBI, EPA and DOE, "Primary Mitigations to Reduce Cyber Threats to Operational Technology," fact sheet, May 6, 2025 (read Oct. 28, 2026). Read it online. ↩
21. NIST SP 800-82 Rev. 3, Section 2.3, OT system types, including 2.3.2 (SCADA, p. 13) and 2.3.4 (PLC-based topologies, p. 21) (read Oct. 28, 2026). Read it online. ↩
22. NIST SP 800-82 Rev. 3, Sections 5.3.6 ("Field I/O (Purdue Level 0) Security Considerations") and 5.3.7 (IIoT), pp. 81 to 82, and Sections 5.4.1 and 5.4.2 (example DCS and PLC architectures, with and without IIoT), pp. 83 to 87 (read Oct. 28, 2026). Read it online. ↩
23. FBI, CISA, NSA, EPA, DOE, U.S. Cyber Command Cyber National Mission Force and others, "Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure," advisory AA26-097A, April 7, 2026, updated July 22, 2026 (read Oct. 28, 2026). Read it online. ↩
24. CISA (NCCIC), "HatMan: Safety System Targeted Malware," Malware Analysis Report MAR-17-352-01, Dec. 18, 2017 (read Oct. 28, 2026). Read it online. ↩
25. NIST SP 800-82 Rev. 3, Section 2.3.7, "Safety Systems," pp. 25 to 26 (read Oct. 28, 2026). Read it online. ↩
26. U.S. Department of Justice, "Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide," March 24, 2022 (read Oct. 28, 2026). Read it online. ↩
27. WaterWorld, "Aliquippa, Pennsylvania, suffers cyberattack on booster station PLC," Nov. 27, 2023 (read Oct. 28, 2026). Read it online. ↩
28. TechCrunch, "CISA confirms hackers targeted over 100 US water systems during July," Aug. 26, 2026 (read Oct. 28, 2026). Read it online. ↩
29. Tenable, "Coordinated cyberattack on Minnesota water utilities: what you need to know," July 28, 2026 (vendor blog summarizing official statements) (read Oct. 28, 2026). Read it online. ↩
30. NIST SP 800-82 Rev. 3, Section 2.3.8, "Industrial Internet of Things," pp. 26 to 28, and Section 5.1.3, "Other Cybersecurity Strategy Considerations," p. 68 (read Oct. 28, 2026). Read it online. ↩
31. PERA project, "Biographical Sketch" of Theodore J. Williams, and "How is PERA Related to ISA?" (pera.net/Standards/Relation_of_ISA_and_PERA.html) (ISA-95 based on parts of the PERA Reference Model for CIM) (read Oct. 28, 2026). Read it online. ↩
32. Wikipedia, "Purdue Enterprise Reference Architecture," citing T.J. Williams, "The Purdue enterprise reference architecture," Computers in Industry 24, no. 2 (1994), pp. 141 to 158, and summarizing ISA-95 time horizons (secondary source; the journal article was not read) (read Oct. 28, 2026). Read it online. ↩
33. International Society of Automation, "ISA-95 Standard," standards page describing Levels 0 to 4 (read Oct. 28, 2026). Read it online. ↩
34. Tripwire, "Revisiting the Relevance of the Industrial DMZ (IDMZ)," undated web article (industry analysis) (read Oct. 28, 2026). Read it online. ↩
35. International Society of Automation, "ISA/IEC 62443 Series of Standards," series page (ISA99 committee established 2002; free ISAGCA resources) (read Oct. 28, 2026). Read it online. ↩
36. CISA, EPA, NSA, FBI and international partners, "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators," Aug. 13, 2025, pp. 1 to 9 (read Oct. 28, 2026). Read it online. ↩
37. CISA, email bulletin announcing "Adapting Zero Trust Principles to Operational Technology" (with the Department of War, DOE, FBI and State Department), April 29, 2026 (read Oct. 28, 2026). Read it online. ↩
38. CISA (then ICS-CERT), "Cyber-Attack Against Ukrainian Critical Infrastructure," ICS Alert IR-ALERT-H-16-056-01, Feb. 25, 2016, updated July 20, 2021 (read Oct. 28, 2026). Read it online. ↩
39. U.S. Senate Committee on Homeland Security and Governmental Affairs, "Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyberattack," hearing, June 8, 2021, S. Hrg. 117-429, testimony of Joseph Blount (read Oct. 28, 2026). Read it online. ↩
40. Norsk Hydro, "Cyber attack," company page on the March 2019 attack (read Oct. 28, 2026). Read it online. ↩
41. JLR, "JLR performance impacted in challenging quarter," media release, November 2025 (read Oct. 28, 2026). Read it online. ↩
42. Cybersecurity Dive, "Ransomware attack forces Coca-Cola to suspend US production at dairy unit," July 17, 2026 (read Oct. 28, 2026). Read it online. ↩
43. Verizon, 2025 Data Breach Investigations Report, Manufacturing (NAICS 31 to 33), pp. 79 to 80 (read Oct. 28, 2026). Read it online. ↩
44. Dragos, press release on the 2026 OT Cybersecurity Year in Review, Feb. 17, 2026 (vendor data) (read Oct. 28, 2026). Read it online. ↩
45. Help Net Security, "Industrial ransomware attacks Q2 2026," Aug. 11, 2026, reporting Dragos quarterly data (read Oct. 28, 2026). Read it online. ↩
46. Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report (ransomware section) (read Oct. 28, 2026). Read it online. ↩
47. FBI, CISA, NSA, EPA and Israel National Cyber Directorate, "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities," advisory AA23-335A, Dec. 1, 2023 (read Oct. 28, 2026). Read it online. ↩
48. CISA, NSA, FBI, EPA, TSA and international partners, "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products," Jan. 13, 2025 (read Oct. 28, 2026). Read it online. ↩
49. CISA, NSA, FBI and partners, "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure," advisory AA24-038A, Feb. 7, 2024 (read Oct. 28, 2026). Read it online. ↩
50. Congressional Research Service, "The Stuxnet Computer Worm: Harbinger of an Emerging Warfare Capability," R41524, Dec. 9, 2010 (read Oct. 28, 2026). Read it online. ↩
51. MITRE, ATT&CK for ICS Matrix (12 tactics as shown Oct. 28, 2026); release in January 2020 per WaterISAC, "MITRE Releases ATT&CK for ICS as Common Lexicon for Industrial Cyber Defense Strategy" (read Oct. 28, 2026). Read it online. ↩
52. SOCRadar, "CISA Industrial Control Systems (ICS) Advisories Recap for 2025" (vendor count; CISA does not publish an annual total) (read Oct. 28, 2026). Read it online. ↩
53. CISA, Known Exploited Vulnerabilities catalog, JSON feed, catalog version 2026.10.27 (1,760 entries; vendor counts by this module's name filter, which may be incomplete) (read Oct. 28, 2026). Read it online. ↩
54. Wikipedia, "Aurora Generator Test," summarizing CNN (Sept. 27, 2007), the 2014 DHS document release and later press reports (secondary source) (read Oct. 28, 2026). Read it online. ↩
55. Idaho National Laboratory, "Industrial Control Systems Cybersecurity Training" (read Oct. 28, 2026). Read it online. ↩
56. Idaho National Laboratory, "Consequence-Driven Cyber-Informed Engineering" (read Oct. 28, 2026). Read it online. ↩
57. U.S. Department of Energy, National Cyber-Informed Engineering Strategy, June 2022 (read Oct. 28, 2026). Read it online. ↩
58. NIST Manufacturing Extension Partnership, "Cybersecurity Resources for Manufacturers" (updated Sept. 30, 2025), "Where to Start," and "About NIST MEP" (read Oct. 28, 2026). Read it online. ↩
59. CyTRICS (Cyber Testing for Resilient Industrial Control Systems), U.S. Department of Energy program site hosted by Idaho National Laboratory (read Oct. 28, 2026). Read it online. ↩
60. Boise State University, "TechHelp receives federal award to continue supporting Idaho manufacturers," March 25, 2026 (read Oct. 28, 2026). Read it online. ↩
61. Idaho Statesman via East Idaho News, "Cyberattacks struck U.S. water systems this summer. Could Idaho be targeted?," Sept. 8, 2026 (read Oct. 28, 2026). Read it online. ↩
62. CISA, email bulletin announcing "CI Fortify: Advice for isolating vital systems" (with Australia's ASD ACSC, the FBI and international partners), July 28, 2026 (read Oct. 28, 2026). Read it online. ↩
63. GOV.UK, "Government backs Jaguar Land Rover with GBP 1.5 billion loan guarantee," Sept. 28, 2025 (read Oct. 28, 2026). Read it online. ↩
64. Prolific North, "GBP 1.9bn JLR hack most economically damaging cyber event to hit the UK, says cybersecurity body," October 2025, reporting the Cyber Monitoring Centre estimate (read Oct. 28, 2026). Read it online. ↩
65. Cloud Security Alliance Labs, "CISA at 38%," research note, April 23, 2026, citing Axios and Nextgov reporting (read Oct. 28, 2026). Read it online. ↩
66. Merck and Co., Form 10-K for fiscal year 2017, filed with the SEC (NotPetya disruption) (read Oct. 28, 2026). Read it online. ↩
67. U.S. Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace," Oct. 19, 2020 (read Oct. 28, 2026). Read it online. ↩
68. U.S. Department of Justice, "Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside," June 7, 2021 (read Oct. 28, 2026). Read it online. ↩
69. Idaho Code 28-51-105, "Disclosure of breach of security of computerized personal information by an agency, individual or a commercial entity" (read Oct. 28, 2026). Read it online. ↩