Loss of Availability (T0826) is the outcome every operator fears: the plant, pipeline or utility stops delivering its product or service because an attack took out the systems it depends on. In ATT&CK for ICS it sits in the Impact tactic (TA0105) and covers both direct attacks on control equipment and IT incidents, usually ransomware, that force an operator to halt production. This guide explains what the technique covers, what the procedure examples show, why detection is about precursors rather than the impact itself, and how to engineer and rehearse the ability to keep running or restart safely. It is written for OT security leads, control engineers and incident responders.
Key takeaways
- Availability is often lost by decision, not sabotage. Two of the examples ATT&CK cites, Colonial Pipeline (in the technique text) and Conficker at a nuclear plant, describe operators halting operations as a precaution after an IT compromise, not attackers touching the process.
- There is no detection analytic for the impact itself. ATT&CK v20 states that no standard detection method exists for T0826, so detection effort goes into the techniques that lead to it.
- Three mitigations carry the technique. ATT&CK maps M0810 Out-of-Band Communications Channel, M0811 Redundancy of Service and M0953 Data Backup, all of which are about continuing or restoring operations.
- IT and OT dependencies decide the blast radius. If billing, scheduling or historian links must work for the process to run, an IT incident becomes an OT outage whatever the segmentation diagram says.
- Manual operation must be practised, not assumed. CISA, FBI, EPA and DOE tell operators to practise and maintain the ability to run OT systems manually, and to test backups, fail-safe mechanisms and standby systems routinely.
What T0826 covers
ATT&CK for ICS v20 describes Loss of Availability as adversaries disrupting essential components or systems to prevent the owner and operator from delivering products or services. It notes that malware may delete or encrypt critical data on HMIs, workstations or databases. The technique is an outcome, so it pairs with whatever method produced it: wipers, ransomware, firmware damage or credential lockout.
Several nearby Impact techniques describe narrower effects. They each have their own ATT&CK page and should be tracked separately in a detection backlog.
| Technique | What is lost | How it relates to T0826 |
|---|---|---|
| T0826 Loss of Availability | The ability to deliver the product or service | The business-level outcome |
| T0828 Loss of Productivity and Revenue | Output and income, including through IT attacks on non-segregated environments | The commercial consequence of the same events |
| T0827 Loss of Control and T0813 Denial of Control | Operators' ability to command the process, sustained or temporary | A common cause of a forced shutdown |
| T0829 Loss of View and T0815 Denial of View | Operators' visibility of process state | Often forces a precautionary stop when operators cannot see |
| T0880 Loss of Safety | Safety functions | The highest consequence case; see the Safety Instrumented Systems Security Guide |
The Enterprise matrix has the IT-side counterparts: T1486 Data Encrypted for Impact and T1489 Service Stop. See the MITRE ATT&CK T1486 Data Encrypted for Impact for the ransomware mechanics, and the MITRE ATT&CK for ICS Guide for how the ICS matrix is organised.
What the procedure examples show
ATT&CK v20 lists the following examples for T0826. They fall into two groups: incidents where the attacker acted on control equipment, and incidents where an IT compromise led the operator to stop.
| Example (ATT&CK ID) | What ATT&CK records | Path to lost availability |
|---|---|---|
| Colonial Pipeline ransomware, 2021 (technique text) | Pipeline operations halted on 7 May and not fully restarted until 12 May | IT compromise, precautionary OT shutdown |
| Conficker (S0608) | An infection at a nuclear power plant forced a temporary shutdown | Commodity malware on plant IT, precautionary stop |
| 2015 Ukraine Electric Power Attack (C0028) | Sandworm Team opened breakers, cutting power to thousands of businesses and households for around 6 hours | Direct action on control systems |
| FrostyGoop Incident (C0041) | Modified control system parameters caused loss of heating to district heating customers | Direct action on control systems |
| Unitronics Defacement Campaign (C0031) | CyberAv3ngers caused multiple businesses to halt operations because PLCs and HMIs were unavailable | Internet-exposed controllers with weak credentials |
| 2026 U.S. Water Utilities Attacks (C0066) | Well and treatment plant shut down temporarily, operators reverted to manual operations; loss of water pressure and flooding reported | Internet-exposed controllers |
| CyberAv3ngers (G1027), 2026 Iranian Water Campaign | Degraded operations across at least seven states, with pressure loss and flooding | Direct action on control systems |
The IT-to-OT shutdown pattern
Colonial Pipeline is the reference case. The NHI Mgmt Group analysis of the Colonial Pipeline ransomware attack records that the attackers entered through a legacy VPN profile with no MFA, and that Colonial shut down the pipeline proactively on 7 May 2021 after DarkSide ransomware was found. The pipeline was a containment decision. The lesson for OT teams is that the shutdown criteria, and the dependencies that drive them, are part of the attack surface.
The direct attack pattern
CISA's advisory AA23-335A on the Unitronics campaign shows how little effort a direct attack can take. CISA reports at least 75 Vision Series devices compromised, at least 34 of them in the US water and wastewater sector, through internet-exposed devices using the default password or no password. The actors replaced ladder logic with logic that had no inputs or outputs and renamed devices, which blocked remote operators from connecting.
CERT Polska's report on the 29 December 2025 attacks on Polish energy (ATT&CK campaign C0063) is a useful counterpoint: damaged RTUs cut communication and remote control between more than 30 renewable sites and the distribution system operator, yet CERT Polska reports that ongoing electricity production was not affected. Losing control and view does not always mean losing availability, if the process can run locally.
Detection: watch the precursors
ATT&CK v20 attaches detection strategy DET0729 to T0826, and its single analytic states that no standard detection method currently exists for this technique. The impact is self-revealing: someone notices the product has stopped. What you can detect is the path to it.
| Precursor | Where to look | Why it matters for availability |
|---|---|---|
| Ransomware staging on IT or the OT DMZ | EDR, domain controller and backup server logs | Encryption of shared services is the most common trigger for a precautionary stop |
| Logons to controllers or HMIs from the internet | Firewall and remote access logs, OT network monitoring | The Unitronics and 2026 water campaigns began with exposed devices |
| Program download, mode change or password change on a controller | OT network monitoring of engineering protocol functions, controller change logs | Precedes logic replacement and lockout |
| Loss of polling or telemetry from field sites | SCADA communication status, historian data gaps | The first operational sign of damaged RTUs or gateways |
| Wiper behaviour on HMIs and servers | EDR, Windows event logs, file integrity monitoring | Wipers turn a recoverable incident into a rebuild |
CISA's Unitronics advisory recommends monitoring for unusual logins to internet-connected devices, ICS management functions that change operating modes or modify programs, and protocols on ports that do not match their normal use. See the OT Network Security Monitoring Guide for sensor placement.
Prevention and resilience: the three ATT&CK mitigations
- M0810 Out-of-Band Communications Channel: ATT&CK says to give operators redundant, out-of-band communication to monitor and control the process, especially when recovering from a network outage, using diverse technologies (it gives cellular networks as an example) to avoid common failure modes.
- M0811 Redundancy of Service: hot standbys in diverse locations keep operations going if the primary system is compromised or unavailable. At the network layer ATT&CK names the Parallel Redundancy Protocol for simultaneous redundant communication on a local network.
- M0953 Data Backup: keep backups of end user systems and critical servers, hardened and separate from the corporate network, and maintain gold-copy images and configurations for key systems so you can recover from attacks on control, view or availability. See the OT Backup, Recovery and Golden Image Guide.
Redundancy needs care. A hot standby on the same network, joined to the same domain and running the same software, will be encrypted by the same ransomware. Diversity of location, credentials and management path is what makes the standby survive.
Reducing the precautionary shutdown
The cheapest availability gain is often to remove the reasons a site must stop when IT is compromised. CISA, FBI, EPA and DOE list segmenting IT and OT, with a DMZ for passing control data to enterprise logistics, among their primary OT mitigations. In practice:
- Map the dependencies: list every IT service the process needs to run, ship or bill (directory, DNS, time, licensing, scheduling, historian export, tank and batch management). See the OT Asset Visibility Guide.
- Move or duplicate critical dependencies into OT: local authentication and time sources, a local copy of production schedules, and a way to record custody transfer or batch data if IT is down.
- Write the shutdown criteria in advance: what evidence of IT compromise triggers a stop, who decides, and what has to be true to restart. A decision made without criteria in the first hour tends to be the most conservative one.
- Remove internet exposure of controllers: CISA's first primary mitigation is to remove OT connections to the public internet, and its second is to change default passwords. See the PLC Security Guide.
- Test the fallback: CISA's guidance is that business continuity and disaster recovery plans, fail-safe mechanisms, islanding capabilities, software backups and standby systems should all be routinely tested.
Decision guidance: keep running, island or stop
| Situation | Usual choice | Trade-off |
|---|---|---|
| IT compromised, OT shows no sign of intrusion, dependencies are local | Island OT at the conduit and keep running | Needs confidence in segmentation and monitoring; residual risk of undetected spread |
| IT compromised, process needs IT for scheduling, metering or billing | Controlled stop, or run under manual records | Lost output against the risk of operating without records; agree with legal and commercial teams in advance |
| Controllers or HMIs showing unauthorised changes | Move to manual or local control, then a safe stop if needed | Requires trained staff on site and a known-good logic copy |
| Safety system behaving unexpectedly | Follow the process safety procedure first | Security investigation waits for the process to be safe |
Small operators, such as water utilities with a few remote sites, gain most from removing internet exposure, changing default passwords, keeping offline logic backups and being able to drive to a site and run it by hand. Large operators should add diverse standby systems, out-of-band telemetry and a rehearsed decision process for IT-driven stops.
Where identity fits
Several availability incidents began with a credential, not an exploit: the unused VPN profile at Colonial Pipeline, default or missing passwords on Unitronics controllers, and controller passwords changed by the actor in the 2026 water attacks. Shared engineering accounts, vendor remote access credentials and service accounts on historians and jump hosts need owners, MFA at the boundary where the device cannot support it, and a recovery path that does not depend on the compromised domain. See the OT and ICS Identity and Access Guide and the OT Remote Access Guide.
Response and recovery
- Make the process safe: operations decide on manual control, controlled stop or islanding using the pre-agreed criteria.
- Contain at the conduit: block traffic at the IT and OT boundary before isolating individual OT hosts, so operators keep their view.
- Preserve evidence: capture logs, network captures and images of affected hosts before rebuilding, where vendor support terms allow. See the OT Incident Response Guide.
- Restore from gold copies: rebuild HMIs and servers from validated images and compare controller logic against offline backups before reconnecting.
- Restart in stages: bring dependencies back in order and confirm each before the next. If the cause was ransomware, follow the OT Ransomware Response Playbook.
Metrics that show it is working
- Manual operation drills: share of critical processes with a manual or local operation drill in the last 12 months.
- Restore time: measured time to rebuild a representative HMI and reload a controller from offline backups, against the target.
- IT dependency count: number of IT services the process needs to keep running, trending down.
- Internet-exposed controllers: count of OT devices reachable from the internet, with a target of zero.
- Backup coverage: percentage of controllers and OT servers with a current, tested offline backup.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK for ICS mitigation |
|---|---|---|---|
| Contingency planning and testing | CP-2 Contingency Plan; CP-4 Contingency Plan Testing | ID.IM-04 | M0953 Data Backup |
| Backups and gold images | CP-9 System Backup; CP-10 System Recovery and Reconstitution | PR.DS-11; RC.RP-01 | M0953 Data Backup |
| Standby systems and sites | CP-7 Alternate Processing Site | PR.IR-03 | M0811 Redundancy of Service |
| Diverse communications | CP-11 Alternate Communications Protocols | PR.IR-03 | M0810 Out-of-Band Communications Channel |
| Dependency and impact analysis | CM-8 System Component Inventory | GV.OC-04; ID.RA-04 | Not mapped by ATT&CK |
| Containment | IR-4 Incident Handling | RS.MI-01 | Not mapped by ATT&CK |
NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (final, 28 September 2023) tailors these controls for OT. NIST's page notes an initial public draft of Revision 4 with comments due by 30 November 2026, so check the current status before citing section numbers. See the NIST SP 800-82 OT Security Guide.
Common failure patterns
- A standby that shares the same failure: redundant servers in the same domain with the same credentials fall to the same ransomware.
- Hidden IT dependencies: the process can run, but the site cannot ship or bill, so it stops anyway, as the Colonial Pipeline shutdown showed.
- No shutdown criteria: the first hour of an incident is spent arguing whether to stop, and the default becomes a full stop.
- Internet-exposed controllers with default passwords: the root cause in the Unitronics campaign, and a cheap one to fix.
- Backups that live online: logic and configuration backups stored on a domain-joined file server are encrypted with everything else.
- Manual operation on paper only: procedures nobody has rehearsed fail when staff numbers are low and the HMIs are dark.
Practitioner checklist
- Document which IT services each OT process needs to run, ship and bill, and remove or localise the ones you can.
- Agree written shutdown and restart criteria with operations, safety, legal and commercial owners.
- Remove every OT device from direct internet exposure and replace default passwords.
- Keep offline, tested backups of controller logic, configurations and HMI and server images.
- Make standby systems diverse in location, credentials and management path.
- Provide an out-of-band channel for operators to monitor and control critical processes.
- Run manual operation drills at least yearly for critical processes and record the time to stable manual control.
- Monitor for controller mode changes, program downloads and password changes, and for logins from the internet.
Standards and references
- MITRE ATT&CK for ICS: Loss of Availability (T0826)
- MITRE ATT&CK for ICS: Impact (TA0105)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
- CERT Polska: Energy sector incident report, December 2025
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Security Guide · OT Ransomware Response Playbook · ATT&CK Impact Tactic Guide