Normal measurements leave an unanswered question
Imagine a PLC program change during production. An engineer describes it as an urgent correction, while the SOC cannot yet associate it with an authorised intervention. Pressure, temperature and cycle time remain normal. Production asks to finish the shift. This scenario illustrates a decision under uncertainty; it is not an account of an identified plant incident.
A normal measurement says something about the observed process, at that time and through that measurement path. It does not establish that all branches, limits or interlocks in the changed program remain appropriate. Conversely, a baseline mismatch alone does not prove malicious activity or require the same response for every asset.
Separate the next download from the logic already running
Restricting the engineering workstation can prevent additional access through that path. It does not remove code already loaded into the controller. Restoring a known revision introduces another process change and is not an automatic containment action. The response needs separate decisions about engineering access, continued operation and restoration.
NIST SP 800-82 Rev. 3 discusses integrity monitoring and incident response while preserving OT performance and safety. Its OT overlay explicitly recognises that shutdown or restart is not always feasible on detection of an anomaly. CUP uses that guidance to propose an asset-specific operating decision rather than an automatic stop triggered by every security alert.
Capture a difference without creating another outage
Where a platform supports it, compare the deployed program and relevant configuration against an approved baseline. Understand the comparison scope: an application checksum, a project export and a firmware version describe different objects. Some values change legitimately during operation, and a checksum does not explain the meaning of the difference.
Preserve the available project, revision information, engineering session and change metadata. Do not assume an online upload is non-disruptive: check vendor support, CPU load, protocol behaviour and the effect of concurrent access. If evidence is incomplete, state that limitation instead of treating an unavailable comparison as a match.
Use independent process information where it exists. A compromised control path should not be the sole basis for declaring the physical process normal. Safety personnel and operations determine the indicators and operating restrictions relevant to the particular process; a generic security runbook cannot substitute for that assessment.
Review prompts drawn from this analysis and its role brief. These identify evidence to examine, not completed verification.
| Review lens | Decision or boundary | Evidence and constraints |
|---|---|---|
| Engineering architecture | Imagine a PLC program change during production. An engineer describes it as an urgent correction, while the SOC cannot yet associate it with an authorised intervention. Pressure, temperature and cycle time remain normal. Production asks to finish the shift. This scenario illustrates a decision under uncertainty; it is not an account of an identified plant incident. | The exercise should begin with an ambiguous alert and end with a recorded operating decision. Measure whether the responsible person can be reached and whether the required evidence is obtainable in the available time. If the only workable plan is to wait indefinitely for forensic certainty, the response design has not addressed the shift team’s problem. |
| Cybersecurity boundary | Separate source facts, hypothetical conditions and proposed acceptance tests. | Test failure conditions and preserve operationally safe investigation and recovery. |
| Operational decision | Fund the evidence and enforcement capability needed for the actual deployment. | Assign the operating decision to an accountable owner and retain the assumptions that make it defensible. |
The decision has a duration
Before an incident, agree which unresolved changes require immediate engineering assessment, which conditions demand a controlled stop and who can authorise a bounded period of continued operation. Include batch quality, environmental consequences, dependencies and the risks introduced by stopping. A permitted interval needs a named owner and an expiry or reassessment condition.
The exercise should begin with an ambiguous alert and end with a recorded operating decision. Measure whether the responsible person can be reached and whether the required evidence is obtainable in the available time. If the only workable plan is to wait indefinitely for forensic certainty, the response design has not addressed the shift team’s problem.
Sources and evidence scope
Public sources do not demonstrate the hypothetical installation or the proposed test outcomes. The cited editions are the editions used, without claiming that they are the latest applicable editions for every project.
Continue this decision.
Move from this analysis into a curated route across related incidents, evidence and operating constraints.