ATT&CK for ICS Impact Tactic Guide: Plan for Loss of Control, View and Safety

Impact is the ATT&CK for ICS tactic that describes the outcome of an attack on an industrial process: operators lose control or view, safety and protection fail, property is damaged, production stops or operational information is stolen. MITRE describes TA0105 as the adversary "trying to manipulate, interrupt, or destroy your ICS systems, data, and their surrounding environment". Its techniques are effects rather than actions, and MITRE itself notes that they "in and of themselves are not necessarily detectable", although the behaviour that leads to them can be mitigated and detected. That changes how defenders should use this tactic: it is the basis for consequence analysis, resilience design and incident response, not for a detection rule per technique. This hub covers all 12 techniques ATT&CK v20 lists under Impact, the real incidents ATT&CK maps to them, the mitigations MITRE assigns and how to plan, measure and recover. It is written for OT security leads, process safety and operations engineers, and incident responders, and builds on the MITRE ATT&CK for ICS Guide.

Key takeaways

• Impact techniques are consequences. ATT&CK v20 detection strategies for all 12 techniques state that no standard detection method currently exists, so detection effort belongs on the techniques that lead to them.
• IT incidents cause OT impact. Ransomware such as LockerGoga, Ryuk, EKANS and NotPetya appears under Loss of Productivity and Revenue (T0828) because unsegregated or dependent IT systems stopped production.
• Loss of view and loss of control are the most recorded effects. In the v20 data T0828 has 10 recorded users, T0829 Loss of View 9, and T0826 Loss of Availability and T0827 Loss of Control 6 each.
• Resilience mitigations dominate. Data Backup (M0953) is mapped to 8 of the 12 techniques, Out-of-Band Communications Channel (M0810) to 7 and Redundancy of Service (M0811) to 5.
• Safety layers are the last line. For Damage to Property (T0879) and Loss of Safety (T0880), MITRE maps Safety Instrumented Systems (M0812) and Mechanical Protection Layers (M0805), which do not depend on the control network.

What Impact means on an industrial site

MITRE explains that Impact can be immediate disruption to the process and the operator, or longer-term damage, and that in some scenarios the process "can appear to function as expected" while it has been altered to serve the adversary over a longer period. It also notes that the adversary may use Impair Process Control (TA0106) and Inhibit Response Function (TA0107) techniques to produce and cover the impact. Three groups help when using the tactic for risk assessment:

• Loss of operator capability: Denial of View (T0815), Loss of View (T0829), Denial of Control (T0813) and Loss of Control (T0827). "Denial" techniques are temporary, recovering once interference stops; "Loss" techniques are sustained and need hands-on intervention.
• Integrity of the process: Manipulation of Control (T0831) and Manipulation of View (T0832), where the process or what operators see is altered, and Loss of Protection (T0837) and Loss of Safety (T0880), where the layers meant to catch faults are compromised.
• Business and physical consequences: Loss of Availability (T0826), Loss of Productivity and Revenue (T0828), Damage to Property (T0879) and Theft of Operational Information (T0882).

MITRE describes T0828, T0882 and T0879 as encompassing the more granular goals of adversaries in targeted and untargeted attacks. For the techniques that typically produce these effects, see the ATT&CK for ICS Impair Process Control Tactic Guide and the ATT&CK for ICS Inhibit Response Function Tactic Guide.

Every technique in the tactic (ATT&CK v20)

The table lists all 12 techniques under TA0105 in ATT&CK v20, checked against the v20 STIX data and the live tactic page in November 2026. "Recorded users" is the number of groups, software and campaigns ATT&CK links to the technique.

What real incidents show

NHI Mgmt Group counted the groups, software and campaigns in the ATT&CK for ICS v20 STIX data that have a "uses" relationship to any ICS technique (41, excluding revoked and deprecated objects). 23 of them are recorded with at least one Impact technique, more than for any other ICS tactic except Initial Access (25). Among those 23, the tactic used alongside Impact most often is Inhibit Response Function, followed by Initial Access, Impair Process Control and Lateral Movement. Several patterns stand out in the procedure records:

The technique descriptions also cite the 2021 Colonial Pipeline ransomware incident, where pipeline operations were halted from 7 May until 12 May, and a targeted attack on a German steel mill reported by the BSI in its 2014 IT Security Report, where control system breakdowns led to the uncontrolled shutdown of a blast furnace. See the ICS Malware History Guide.

Mitigations MITRE maps across the tactic

The mitigation relationships for Impact are almost entirely about resilience and independence, because by the time an effect occurs, prevention has already failed. The counts are the number of Impact techniques each mitigation is mapped to in v20.

MITRE maps no mitigation to Loss of Protection (T0837) in v20. In practice the controls for it are those that protect relays and protection devices from the techniques that cause the loss, covered under Inhibit Response Function.

Detection and measurement

Since there is no standard detection for the effects themselves, the job splits in two: detect the precursor techniques, and recognise impact quickly when it happens so that response starts in minutes.

Linked technique pages carry the detection detail for precursors, for example T1695 Block Communications, T0892 Change Credential and T1692 Unauthorized Message.

Metrics that show resilience:

• Percentage of critical controllers and HMIs with an offline backup restored successfully in the last 12 months.
• Time to restore a controller program and HMI project from backup in a drill, against the recovery time objective.
• Percentage of critical processes with a documented and rehearsed manual operating procedure.
• Percentage of critical alarms and commands with an out-of-band path.
• Number of OT functions with an undocumented dependency on IT services such as Active Directory, ERP or licence servers (target zero).
• Time from a simulated loss of view to the incident being declared.

Where identity fits

Several of the clearest Impact cases are identity failures. ATT&CK records that in the 2026 U.S. Water Utilities Attacks the adversary changed passwords on internet-facing controllers, locking out operators and causing loss of control and view, and that CyberAv3ngers locked victims out by changing PLC management passwords.

• Device credentials: unique per device, vaulted, with a tested recovery method, so a password change does not become a sustained Loss of Control.
• Shared dependencies: when HMIs authenticate against the corporate directory, a directory outage or ransomware event can cause Loss of View. Keep local break-glass accounts for operator stations.
• Remote access identities: vendor and remote engineering accounts are frequent paths to controllers. See the OT and ICS Identity and Access Guide and the OT Remote Access Guide.

Planning for Impact

1. Run a consequence analysis: for each critical process, walk through the 12 Impact techniques and record the worst credible outcome, the safety layers that would stop it and how long the business can tolerate it.
2. Map dependencies: list every IT service the OT environment needs to keep running. LockerGoga, Ryuk and NotPetya cases show that the impact often comes from these.
3. Build independence: SIS and mechanical protection that do not rely on the control network; out-of-band paths for critical alarms and commands.
4. Back up and test restores: offline copies of programs, configurations, firmware and HMI projects, with restore drills on a test bench before relying on them in production.
5. Write and rehearse manual operations: agree with operations when to fall back to manual control and how to return to automatic, including the checks needed before reconnecting systems.
6. Prepare the response: OT incident playbooks for each effect, with decision points owned by operations and safety, not only security. See the OT Incident Response Guide.

Decision guidance: small sites usually cannot afford redundant servers everywhere, so prioritise offline backups, manual procedures and mechanical protection, which give the most resilience for the cost. Large operators should use the technique table as a common consequence taxonomy across sites and fund redundancy and out-of-band paths where the tolerable outage is shortest. Where an effect such as Loss of Safety could harm people, independent engineering safeguards take priority over any cyber control.

Framework mapping

See the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide.

Common failure patterns

• Writing detection rules for the effect: by the time Loss of Control is visible, the attack has succeeded. Effort belongs on precursors and on fast recognition.
• Untested backups: controller backups that have never been restored, or that are stored on the engineering workstation a wiper will destroy.
• Hidden IT dependencies: HMIs that need domain authentication or a licence server, so an IT incident becomes an OT outage.
• Trusting the HMI during an incident: manipulation of view means the screen may be wrong. Responders need independent measurements and local gauges.
• Internet-exposed controllers with default or shared passwords: the pattern behind the recorded water sector lockouts.
• Manual procedures nobody has practised: Norsk Hydro could switch many sites to manual operation; many organisations would find their procedures out of date.

Practitioner checklist

• A consequence analysis covers each Impact technique for every critical process.
• Offline backups of programs, firmware and HMI projects are restored in a drill at least yearly.
• Critical alarms and commands have an out-of-band path.
• SIS and mechanical protection are independent of the control network.
• OT dependencies on IT services are documented and minimised.
• Device credentials are vaulted with tested recovery, and no controller is reachable from the internet.
• Manual operating procedures are current and rehearsed with operations.
• Detection covers the precursor techniques linked above, using ATT&CK v20 IDs.
• OT incident playbooks name operations and safety decision owners for each effect.

Standards and references

• MITRE ATT&CK for ICS: Impact (TA0105)
• MITRE ATT&CK for ICS: Impair Process Control (TA0106)
• MITRE ATT&CK for ICS: Inhibit Response Function (TA0107)
• MITRE: ATT&CK STIX Data
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Backup, Recovery and Golden Image Guide · OT Incident Response Guide · Safety Instrumented Systems Security Guide