ABB System 800xA and Ability Security Guide: Roles, Permissions, Audit and Hardening

ABB System 800xA, sold under the ABB Ability brand, gives asset owners a detailed permission model, an audit trail and optional re-authentication, but each of these has to be designed and switched on by the site to deliver its value. System 800xA is a distributed control system (DCS) used in process industries such as oil and gas, chemicals, pulp and paper, mining and power. Its operator and engineering workplaces, Aspect and Connectivity Servers run on Windows, while AC 800M controllers run the control logic. This guide explains how identity and access work in 800xA, which groups and permissions are privileged, how to handle installation and service accounts, what to log, and a hardening baseline built on ABB's published guidance. It goes deeper than the OT Security Guide and is written for DCS engineers, OT security teams and asset owners. Some configuration detail comes from the System 800xA 5.1 Administration and Security manual, so confirm names and menus for your exact release with ABB.

This is an independent guide from NHI Mgmt Group, based on ABB's public documentation as of November 2026. It is not sponsored or reviewed by ABB. Product features change, so confirm settings against ABB's current documentation.

Key takeaways

• Two Windows groups decide who gets in. IndustrialITUser holds every 800xA user and IndustrialITAdmin holds full access; keep the admin group to a small, named list.
• Permissions live on Security Definition aspects. Entries combine a permission, Allowed or Denied, a user or group and a node scope, so access can depend on who, what and from where.
• Roles shape the interface, permissions grant rights. Operator, Application Engineer and System Engineer roles decide what a user sees; the permissions on objects decide what they can change.
• Turn on the audit trail and re-authentication. The Audit Trail Config aspect and the optional Advanced Access Control features give attributable records and a second check on critical writes.
• Use ABB-validated updates and hardening. ABB validates Microsoft and antivirus updates for its control systems and applies hardening during engineering and commissioning; generic baselines can break DCS functions.

How identity and access work in ABB System 800xA

800xA relies on Windows for authentication. ABB's built-in security page describes users authenticating through Windows Authentication with Active Directory or workgroups, and access that depends on user, role and location, set down to object and attribute level: "who is allowed to do what actions from where, with which object". The system then layers its own authorisation model, held in the Aspect Directory, on top of the Windows identity.

Windows groups and 800xA user groups

The 5.1 Administration and Security manual describes two Windows groups that gate the system. IndustrialITUser should contain all 800xA users, and membership is required to start a workplace. IndustrialITAdmin has full access to the system and should contain at least one but only a limited number of users. Windows groups are linked to 800xA user groups in the User Structure, on the User Group Definition aspect, using Associate Windows Group. The predefined 800xA groups are Everyone, Administrators, Operators, Application Engineers, Application Managers and System Engineers. The manual notes that security is disabled for members of the 800xA Administrators group, and advises against using those identities for daily work.

Domain or workgroup

Whichever design you choose, keep the DCS identity store separate from the corporate domain, with no trust or a tightly controlled one, so a corporate credential compromise does not reach the control system. The OT and ICS Identity and Access Guide covers the design options.

Security Definitions and how access is evaluated

Permissions are set by adding a Security Definition aspect to an Aspect Object, which requires the Security Configure permission. Each definition has an Authority Range (None, Structure, Object, or Domain for system objects) and a list of entries. An entry names a permission, an Allowed or Denied type, a user or group, and a node scope of one, several or all nodes. The manual sets out the evaluation order:

1. Node-specific entries are checked before all-node entries.
2. Denied entries are checked before Allowed entries.
3. If nothing grants or denies access, the permission is denied.

Two cautions from the manual matter for security reviews: the owner of a security aspect can still edit it even when permissions would block editing, and the design should be kept simple. In particular, do not set Denied entries for the Everyone group's Read permission on the domain object.

Admin roles and privileged access

User roles and permissions are separate in 800xA. Roles (Operator, Safety Operator, Application Engineer, System Engineer, Application Manager) control what the interface shows and are assigned per user group; they do not grant permissions. Permissions are what an attacker with Valid Accounts (T0859) would use to change the process, alter alarms (T0838, T0878) or download logic (T0843). The default permission assignments in the 5.1 manual show where privilege concentrates:

• Separate daily and admin identities: operators and engineers work with standard accounts, and Windows and 800xA administration uses separate accounts that are not members of the 800xA Administrators group for daily work.
• Use Log Over for temporary elevation: Log Over lets a user with higher rights take over a running workplace without closing open windows. It changes only 800xA system permissions, while Windows file access stays with the originally logged-in user, and it is not intended for engineering work. The Logover Settings aspect offers a revert timer and an inactivity user so elevated sessions fall back automatically. Three failed authentication attempts close the dialog and create a system event, and a LogoverFailure system alarm can be raised.
• Require re-authentication and approval for critical actions: ABB's Advanced Access Control page describes optional re-authentication for critical operations, such as writing data to the control system, batch operations and configuration changes, and secondary authentication, where a second person with the matching authority enters their own credentials to approve. In the 5.1 manual these are set per property with Property Attribute Override aspects (None, Reauthenticate, Double authenticate), and changing permissions or the audit configuration then requires re-authentication.
• Control vendor and integrator access: give ABB and integrator staff named, time-limited accounts and route remote sessions through a brokered, recorded service. ABB lists secure remote access among its system configuration and maintenance guidelines. See the OT Remote Access Guide.
• Protect the safety boundary: the Safety Operator role exists for trusted operators who modify write-confirmation data in high integrity controllers, so treat safety engineering and confirmation rights as the most privileged in the plant. See the Safety Instrumented Systems Security Guide.

Integrations, API tokens and service accounts

800xA identities are not only people. The installation account, the system Service Account and integration accounts for historians, MES, asset management and OPC clients are non-human identities that often hold more access than any operator and are rarely reviewed.

• Installation and Service Accounts: the 5.1 manual names an installation account (800xAInstaller in its examples) and a Service Account created during setup, and says to use separate accounts and passwords for the two. It also notes that audit logging is not possible when the Service Account is used, so never use it for interactive work, record who knows its password, and change the password through the procedure ABB documents for your release.
• Integration accounts: give each external system its own Windows account, a matching 800xA group with only the permissions it needs (often Read only), and a named owner. Do not run historian or reporting interfaces under operator, engineer or administrator accounts.
• OPC and data access: where business systems only read data, publish it through a DMZ server or one-way gateway rather than opening a path into the control network. See the OPC Classic and DCOM Hardening Guide, the OPC UA Security Guide and the Data Diodes and Unidirectional Gateways Guide.
• Network traffic between nodes: ABB's built-in security page describes an IPsec Configuration Tool for authenticating and encrypting traffic between clients and servers that are domain members, with explicit exceptions for named nodes that do not support IPsec. Keep that exception list short and reviewed.
• Files and exchange folders: the manual advises saving Bulk Data Manager, Document Manager and Reuse Assistant files only in secured folders and virus scanning import files. Restrict shares to named accounts, and route removable media through a scanning kiosk. See the Removable Media and USB Control Guide.

The wider discipline for these accounts, including ownership, rotation and review, is covered in the Windows Services and Service Account Security Guide.

Logging and detection

800xA records system activity in its own audit trail and relies on Windows for operating system events. ABB lists the Audit Trail as a product in its fundamental security tier.

• Audit trail: one Audit Trail Config aspect in the Admin Structure, under the system's domain object, controls auditing for the whole system. It can log all generic events or selected event classes. Each entry records date and time, node, user name, operation type and the affected object, property or aspect, and events appear in the Alarm and Event list.
• Event classes to enable: the 5.1 manual lists classes including ConfigurationChange, AuditEvent_Security, AuditEvent_OperatorAction (which records the value before and after an operator change), AuditEvent_ForcedChange and AuditEvent_Acknowledge. For engineering activity, add AuditEvent_Deploy, AuditEvent_Upload, AuditEvent_Import, AuditEvent_Backup and AuditEvent_Restore.
• Security audit per permission: on a Security Definition aspect you can audit each permission for Allowed, Denied or both, and system alarms can be raised for AuditEvent_AccessDenied, SignatureFailure and other authentication failures.
• Windows security logs: the manual points to the Audit Policy in Local Security Policy, the Maximum security log size and Retain security log settings. In a domain, set these with Group Policy and forward logon, account and group change, service installation and process creation events to the OT SIEM. See the Windows Event Forwarding Guide.
• IT asset health: ABB's PC, Network and Software Monitoring package represents computers, switches and software as IT Assets, raises alarms when problems are detected or anticipated and shows status in the System 800xA Status Viewer. Use it alongside security monitoring, not instead of it.
• Network monitoring: passive monitoring of the client/server and control networks for new hosts and engineering traffic outside change windows. See the OT Network Security Monitoring Guide.

Metrics

1. Number of members of IndustrialITAdmin and the 800xA System Engineers group, reviewed quarterly against a named list.
2. Percentage of controller downloads and configuration changes in the audit trail that match an approved change record.
3. Percentage of critical properties protected by re-authentication or double authentication.
4. Percentage of 800xA nodes at the current ABB-validated Microsoft and antivirus update level.
5. Number of interactive logons by the Service Account or shared accounts (target: zero).

Hardening baseline

ABB groups its offering into built-in security (System Hardening and System Configuration, plus the My Control System service), fundamental security (Audit Trail, PC, Network and Software Monitoring, Cyber Security Fingerprint and validated antivirus and Windows security updates through Automation Sentinel) and enhanced security (Digital signature, Advanced Access Control and Policies and Guidelines Consultancy). ABB states that it applies security guidelines during engineering, commissioning and maintenance, covering secure default settings and hardening, antivirus, patch management, access and account management, backup and recovery, plant network topology and secure remote access. Build your baseline on those areas, in this order:

1. Inventory: list every 800xA node, its role (Aspect, Connectivity, Application Server, client, domain controller), 800xA version, Windows version, controller firmware and network placement. See the OT Asset Visibility Guide.
2. Zone the system: separate the control network, the client/server network and any DMZ with firewalls. ABB's page notes that AC 800M controllers and communication cards use a network filter that blocks unsupported traffic and protects the device in network storms, which complements but does not replace zone firewalls. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
3. Clean up identities: trim IndustrialITAdmin, map each 800xA group to a dedicated Windows group, disable shared logins and give integrations their own accounts.
4. Design Security Definitions: start from the defaults, add node-scoped entries so engineering permissions apply only from engineering workplaces, and document every Denied entry.
5. Turn on auditing and Advanced Access Control: enable the audit trail classes above, then add re-authentication and approval to setpoint writes on critical loops, Force I/O and downloads. Pilot on one area and confirm operators can still respond in an upset.
6. Patch with validated updates: apply Microsoft and antivirus updates only after ABB validation, delivered through My Control System or the System Update Service, testing first on a spare or simulation node during a planned outage. For vendor security advisories, subscribe to the email alerts or the RSS and CSAF feeds on the ABB cyber security alerts and notifications page and apply ABB security updates promptly.
7. Lock down workplaces and allowlist: use the Windows Group Policy lockdown ABB describes for operator workplaces and an application allowlisting product validated for your release. See the OT Endpoint Protection Guide.
8. Back up and rehearse: 800xA offers total and selective backups and restores through system administration. Keep offline copies of system backups, controller applications and node images, and test a restore. Rollback for any hardening step is a restore of the pre-change backup. See the OT Backup, Recovery and Golden Image Guide.

Decision guidance

• Small, isolated system: a workgroup within ABB's stated limits, with identical local accounts managed by a documented process, may be simpler; move to a dedicated domain as soon as the system grows past those limits.
• Large or multi-area plant: a dedicated DCS domain with Group Policy, IPsec between members, central log forwarding and node-scoped Security Definitions.
• Regulated batch or pharmaceutical sites: use Digital signature and double authentication, with the First and Second Signature permissions held by different groups.

Framework mapping

Common misconfigurations

• Daily work as an administrator: engineers left in the 800xA Administrators group, where security is disabled, so every action bypasses Security Definitions.
• A large IndustrialITAdmin group: integrators and former staff remain members after commissioning, giving full system access with no review.
• Shared operator and service logins: one console account per shift, or the Service Account used interactively, so the audit trail cannot attribute actions.
• Audit trail never enabled: the Audit Trail Config aspect is left at defaults, so configuration changes, forced values and downloads are not recorded.
• Complex Denied entries: layered Allowed and Denied entries across structures that nobody can explain, including Denied Read for Everyone on the domain object, which the manual warns against.
• Corporate domain reach: 800xA nodes joined to, or trusted by, the corporate domain, so a corporate credential compromise reaches the DCS.

Practitioner checklist

• Inventory 800xA nodes, versions, Windows builds, controller firmware and network zones.
• Reduce IndustrialITAdmin and System Engineers membership to named people with separate admin accounts.
• Keep the 800xA Administrators group out of daily use.
• Give the Service Account, installation account and each integration a documented owner and no interactive use.
• Review Security Definitions, add node scope for engineering permissions and remove unexplained Denied entries.
• Enable the audit trail classes for security, configuration, operator actions and engineering activity, and forward them with Windows logs to the OT SIEM.
• Apply re-authentication and approval to critical writes, Force I/O and downloads.
• Install only ABB-validated Microsoft and antivirus updates and subscribe to ABB security advisories.
• Keep the DCS identity store separate from corporate identity and broker vendor access.
• Keep offline, tested backups and rehearse a restore.

Standards and references

• ABB: Cyber Security with ABB Ability System 800xA
• ABB: System 800xA 5.1 Administration and Security
• ABB: 800xA Built in security
• ABB: 800xA Advanced Access Control
• ABB: Validated security updates for ABB Distributed Control Systems
• ABB: System 800xA is ISASecure
• ABB: Cyber security alerts and notifications
• MITRE ATT&CK: Valid Accounts (ICS)

Related NHI Mgmt Group resources: OT Security Guide · HMI and SCADA Server Hardening Guide · Engineering Workstation Security Guide · OT Third-Party and Integrator Access Guide