D3-OPR Operating Mode Restriction: Keep Controllers in Run Mode and Prove It

A PLC or safety controller left in Program or Remote mode will accept new logic from anyone who can reach it on the network. D3-OPR Operating Mode Restriction is the MITRE D3FEND countermeasure that addresses this: D3FEND defines it as "Restricting unauthorized changes to the operating mode prevents devices from switching into inappropriate or vulnerable states during normal use." In the D3FEND ontology it is a child of Access Mediation in the Isolate tactic, and it restricts the OT Controller Operating Mode artefact. This card covers what the control changes on a controller, which attacker behaviour it is relevant to, where it is implemented, how to prove it holds, and where it stops helping. It is written for OT engineers, control system owners and the security teams who monitor them. For the parent technique, see the MITRE D3FEND Access Mediation Implementation Guide.

Key takeaways

• Run mode is the protected state. On most controllers Run disables program upload and download, so keeping the controller there removes the easiest path to changing its logic.
• The key is a credential. A physical key switch only restricts mode if the key is removed, stored and issued under change control, as D3FEND's own guidance says.
• D3FEND lists no ATT&CK mapping for it yet. Its relevance to T0858 Change Operating Mode comes from the shared OT Controller Operating Mode artefact, which is NHI Mgmt Group's reading of the ontology.
• Software mode changes need equal treatment. Controllers without a hardware switch, or switched to Remote, accept mode changes through engineering software, so passwords and role-based access in that software are part of the control.
• Restriction needs monitoring beside it. An alarm whenever a controller leaves Run is what turns a forgotten key into a short exposure rather than a standing one.

D3-OPR at a glance

How it works

D3FEND's knowledge base article is short and practical. Many OT controllers use key switches to change modes such as Program, Run, Remote or Stop. The key should be left in the appropriate position, for example Run or Remote, during normal operations, and the key management procedure should include removing the physical key from the switch when it is not in use.

Why the mode matters is set out in ATT&CK for ICS under T0858 Change Operating Mode. Modes vary by vendor, but the common pattern is:

Vendor detail matters. Dragos describes Triconex safety controllers as having four key positions, where Run is read-only and rejects writes from TriStation, Modbus masters or external hosts unless the control program opens a gated window, while Remote allows writes to program variables but not program downloads. It also notes that Rockwell ControlLogix has three physical positions but five operating modes, and that moving the key from Program to Remote leaves the controller in Remote Program until the key returns to Run. Read the mode table for every controller family you run rather than assuming Run means the same thing everywhere.

Where there is no hardware switch, the Top 20 Secure PLC Coding Practices (practice 2, Track operating modes) recommends software controls such as password protection in the engineering software for reading and writing PLC code. That puts the engineering workstation and its accounts inside the scope of D3-OPR. See the OT and ICS Identity and Access Guide.

ATT&CK techniques related to D3-OPR

Relationship type: none listed by D3FEND. The D3FEND technique page for D3-OPR states that there are no related offensive techniques in the current release (checked November 2026). The rows below are NHI Mgmt Group's reading of the D3FEND ontology, where the same OT Controller Operating Mode artefact that D3-OPR restricts is the artefact these ATT&CK for ICS techniques modify. Treat them as "where this control is relevant", not as an official mapping. IDs were checked against ATT&CK v20.

ATT&CK's procedure example for Triton on T0858 notes that the Tricon controller had to be in Program mode before the payload could be injected, and Dragos states that with the key in Run the attack would not have succeeded. The FBI's March 2022 notification on TRITON recommends change management for run-state key positions, regular audits of physical keys, and operator station alarms whenever the safety controller's key switch is in Program mode. See the ICS T0858 Change Operating Mode, the MITRE ATT&CK for ICS T0800 Activate Firmware Update Mode and the ICS Malware History Guide.

Where it is implemented

The network and workstation rows overlap with D3FEND's network isolation techniques; this page does not repeat them. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide and the PLC Security Guide.

Implementation steps

1. Inventory controllers and their modes. For each controller record the model, the available modes, whether it has a hardware switch, its current position and who holds the key. Use passive asset visibility rather than active polling of fragile devices.
2. Define the normal state per controller. Usually Run; document any controller that must stay in Remote for an operational reason, and what compensating software control applies.
3. Bring keys under custody. Remove keys from switches, store them locked, and issue them only against an approved work order. Record issue and return.
4. Turn on software protection. Enable mode and program protection in the engineering software with individual credentials, and restrict which workstations can connect.
5. Add the alarm before enforcing. Configure the HMI or monitoring platform to alarm whenever a controller is not in its normal state, and run it for a period to learn how often mode changes occur legitimately.
6. Return to Run after every change. Make "key back to Run and removed" a closing step on every maintenance work order, confirmed by the alarm clearing.
7. Plan rollback. The rollback for a mode restriction is operational: a documented emergency key issue path with after-the-fact review, so staff never leave keys in switches "just in case".

How to verify it works

• Walkdown: physically check a sample of controllers each quarter for key position and key presence, and compare against the inventory.
• Status bit check: read the controller's mode status into logic or the HMI. Dragos describes reading key position through a Get System Value instruction on Rockwell controllers, placed in a password-protected block, and alarming if that block is disabled.
• Negative download test: in a maintenance window on a test or non-critical controller, confirm that a download from the engineering workstation is refused while the controller is in Run.
• Network detection: ATT&CK's detection strategy for T0858 describes alerting on ICS protocol mode-change commands from sources not on the approved engineering workstation list, outside an approved change window. Confirm your monitoring raises that alert with a planned test.

For monitoring architecture, see the OT Network Security Monitoring Guide.

Limits, bypasses and failure patterns

• Key left in the switch: the control reverts to whatever position the last engineer chose. This is the most common way the restriction disappears.
• Remote as the permanent setting: Remote hands mode changes to software, so the protection is only as strong as the engineering software's credentials and the network path to the controller.
• Compromised engineering workstation during legitimate work: when the key is turned to Program for a planned change, any malware on the workstation can use that window. Pair D3-OPR with workstation hardening and project file integrity checks.
• Vendor behaviour differs: some controllers still accept certain writes or firmware operations in Run. Check vendor documentation for each family.
• Alarm fatigue: if mode alarms fire constantly during commissioning they get suppressed and forgotten. The Top 20 guidance allows disabling the alarm in test phases only if the plant is isolated from higher network levels.

Framework mapping

Related countermeasures

• Sibling under Access Mediation: D3-OVAR OT Variable Access Restriction protects individual tags and registers while the controller runs.
• Default credentials: engineering software and controller passwords left at vendor defaults undo software mode protection. See the D3-CDP Change Default Password.
• Framework context: see the MITRE ATT&CK for ICS Guide and the MITRE D3FEND Guide.

Practitioner checklist

• Record mode capability, current position and key holder for every controller.
• Set Run (or the vendor's protected position) as the normal state and document every exception.
• Remove keys from switches and issue them only against approved work orders.
• Audit physical keys on a schedule and reconcile against the issue log.
• Enable mode and program protection in engineering software with individual credentials.
• Restrict mode-change and download functions to designated engineering workstations.
• Alarm whenever a controller leaves its normal mode, with a re-alert before shift change.
• Close every maintenance work order only after the controller is back in Run and the alarm clears.

Standards and references

• MITRE D3FEND: Operating Mode Restriction (D3-OPR)
• MITRE ATT&CK for ICS: T0858 Change Operating Mode
• MITRE ATT&CK for ICS: M0800 Authorization Enforcement
• FBI: TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems
• PLC Security: Top 20 Secure PLC Coding Practices
• Dragos: The Value of PLC Key Switch Monitoring
• NIST: SP 800-53 Rev 5, Security and Privacy Controls

Related NHI Mgmt Group resources: MITRE D3FEND Access Mediation Implementation Guide · PLC Security Guide · OT Security Guide · ICS T0858 Change Operating Mode · MITRE D3FEND Guide