OT and ICS Security Glossary: PLC to IEC 62443

Security teams and control engineers often use the same words for different things, and that gap causes failed projects, unsafe changes and audit findings in operational technology. This glossary gives short, precise definitions of the terms practitioners meet when securing industrial control systems: controllers and supervisory systems (PLC, RTU, DCS, SCADA, HMI), safety systems (SIS, SIF, SIL), industrial protocols, the Purdue model, the ISA/IEC 62443 vocabulary of zones, conduits and security levels, MITRE ATT&CK for ICS and the best known ICS malware. Definitions draw on NIST SP 800-82 Rev. 3, the ISA/IEC 62443 series and MITRE ATT&CK for ICS, quoted with attribution where the source wording matters. It is written for IT security staff moving into OT, OT engineers taking on security duties, auditors and buyers. For the wider programme, start with the OT Security Guide; identity and non-human identity terms are covered in the NHI and IAM Glossary.

A

Achieved security level (SL-A): In IEC 62443, the security level a zone or conduit actually delivers once it is built and operated, including compensating countermeasures and how well procedures are followed. It is compared with the target security level to find gaps. See the IEC 62443-3-3 and 4-2 Security Levels Guide.
Air gap: Physical isolation of a control network from any other network. True air gaps are rare in practice: removable media, laptops brought in by contractors, vendor modems and historian links routinely bridge them, which is how Stuxnet reached its targets. Treat an air gap as a claim to verify, not a control to rely on. See the Data Diodes and Unidirectional Gateways Guide.
Alarm suppression: Preventing an alarm from reaching operators, either through a legitimate shelving feature or by an attacker. In MITRE ATT&CK for ICS it is technique T0878. Unauthorised changes to alarm limits (T0838 Modify Alarm Settings) are a related warning sign worth monitoring. See MITRE ATT&CK for ICS T0878 Alarm Suppression.
Application allowlisting: An endpoint control that permits only approved executables, scripts and libraries to run. It suits HMIs, engineering workstations and SCADA servers well because their software rarely changes, and it is often the main compensating control where antivirus updates or patching are restricted. See the OT Endpoint Protection Guide.
Asset owner: In IEC 62443, the organisation accountable for operating an industrial automation and control system and its risk: the plant operator or utility. ISA lists asset owners alongside product suppliers, integrators and service providers as the main roles the series addresses, and IEC 62443-2-1 sets the asset owner security programme requirements. See the IEC 62443-2-1 Asset Owner Security Programme Guide.
ATT&CK for ICS: The MITRE knowledge base of adversary tactics and techniques against industrial control systems, with technique IDs in the T08xx range (for example T0843 Program Download and T0880 Loss of Safety) plus newer IDs such as T1691. Its tactics include two ICS specific ones, Inhibit Response Function and Impair Process Control. See the ATT&CK for ICS Impair Process Control Tactic Guide.

B to C

BACnet: A data communication protocol for building automation and control networks (heating, ventilation, lighting, access). BACnet/IP commonly uses UDP port 47808. The original protocol has no strong authentication; BACnet Secure Connect adds TLS based transport with certificates. See the BACnet and BACnet Secure Connect Guide.
Basic process control system (BPCS): The control system that runs the process in normal operation, as distinct from the safety instrumented system that takes it to a safe state when limits are exceeded. Functional safety practice keeps the two independent, and IEC 62443-3-2 expects safety related assets to sit in their own zones. See the Safety Instrumented Systems Security Guide.
Building automation system (BAS): Also called a building management system (BMS): the controllers, sensors and supervisory software that run heating, ventilation, air conditioning, lighting and sometimes physical access. NIST SP 800-82 Rev. 3 includes building automation in its definition of OT. BAS networks are often managed by facilities teams and contractors outside the security programme. See the Enterprise IoT Security Programme Guide.
Brownfield: An existing, operating plant with legacy controllers, flat networks and long lived assets, as opposed to a new (greenfield) design. Most OT security work is brownfield, which is why compensating countermeasures, passive monitoring and staged segmentation matter more than redesign. See the OT Security Assessment Guide.
Capability security level (SL-C): In IEC 62443, the security level a component or system can provide when properly configured, without additional compensating countermeasures. Product suppliers claim SL-C against IEC 62443-4-2 (components) or 62443-3-3 (systems); integrators combine components to meet the target security level. See the IEC 62443-4-1 and 4-2 Secure Product Development Guide.
CIP Security: The ODVA extension to the Common Industrial Protocol used by EtherNet/IP that adds device authentication, integrity and confidentiality, using TLS and DTLS with certificates or pre-shared keys. Support depends on the device and firmware, so mixed estates often run secured and unsecured CIP side by side. See the EtherNet/IP and CIP Security Guide.
Compensating countermeasure: A control applied at system level when a component cannot meet a requirement itself, for example a firewall and allowlisting in front of a controller that cannot authenticate users. IEC 62443-3-3 uses the term, and the countermeasure must be documented and counted when assessing the achieved security level. See the IEC 62443 Guide.
Conduit: In IEC 62443, a logical grouping of communication channels that connect two or more zones and share the same security requirements. A conduit specification records its endpoints, protocols, direction, owner and the device that enforces it. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Consequence-driven cyber-informed engineering (CCE): A methodology from Idaho National Laboratory that starts from the worst physical consequences an organisation must avoid, maps the systems and dependencies that could cause them, and then engineers out or limits those paths, often with non-digital protections. See the Consequence-driven OT Risk (CCE) Guide.
Controller operating mode: The state of a PLC or safety controller, typically Run, Program (or Stop) and Remote, sometimes selected with a physical key switch. Program and Remote modes allow logic changes, so an unexpected mode change is a high value detection. ATT&CK for ICS covers it as T0858 Change Operating Mode. See the ICS T0858 Change Operating Mode.
Cyber PHA: Cyber process hazard analysis, sometimes called cyber HAZOP: extending a plant's process hazard analysis to ask what happens if a control or safety system is manipulated, and whether non-digital safeguards still prevent the hazard. It links security risk to physical consequence. See the OT Cyber Physical Risk and Safety Guide.

D to E

Data diode: A hardware device that physically allows data to flow in one direction only, usually from OT out to IT. A unidirectional gateway adds software that replicates historians, files or alarms across the one way link so that business users get data without any return path into the plant. See the Data Diodes and Unidirectional Gateways Guide.
Data historian: NIST SP 800-82 Rev. 3 defines it as a centralised database supporting data analysis using statistical process control techniques. In practice historians collect time series tag data from control systems and are often mirrored into the industrial DMZ, which makes them a common bridge between IT and OT. See the OT Process Historian Security Guide.
Defence in depth for OT: Layering independent controls (policy, physical security, segmentation, host hardening, monitoring, safety systems) so that one failure does not lead to a physical consequence. IEC 62443 and NIST SP 800-82 both build on it. See the OT Security Guide.
Distributed control system (DCS): NIST SP 800-82 Rev. 3, quoting the ISA dictionary, describes distributed control as control achieved by intelligence that is distributed about the process. A DCS is typically one vendor's integrated system of controllers, I/O, operator stations and engineering tools, used in continuous process plants such as refineries and chemical works. See the OT Security Guide.
DNP3: Distributed Network Protocol 3, widely used between SCADA masters and outstations in electricity and water. DNP3 over TCP commonly uses port 20000. Secure Authentication (SAv5, later SAv6) adds challenge response authentication of critical messages, but deployment is uneven. See the DNP3 and DNP3 Secure Authentication Guide.
Engineering workstation (EWS): The computer with vendor software used to write, download and upload controller logic and configure field devices. Compromise of an EWS gives an attacker the same power as a control engineer, which is why INCONTROLLER and Stuxnet both targeted engineering tools and project files. See the PLC Security Guide.
Essential function: In IEC 62443, a function needed to maintain health, safety, the environment or availability of the equipment under control: protection, control, and the operator's ability to view and operate. Security controls must not stop essential functions, for example account lockout must not lock an operator out of an HMI during an upset. See the IEC 62443-3-3 and 4-2 Security Levels Guide.
EtherNet/IP: An industrial Ethernet protocol that carries the Common Industrial Protocol (CIP) over standard TCP and UDP, commonly TCP port 44818 for explicit messaging and UDP port 2222 for implicit I/O. It is common in discrete manufacturing. See the EtherNet/IP and CIP Security Guide.

F to H

Field device: Sensors, transmitters, actuators, valves, drives and analysers at Purdue Level 0 that measure or act on the physical process. Many communicate over fieldbuses or 4 to 20 mA loops with HART and have little or no security capability, so they are protected by the zones around them. See the OT Asset Visibility Guide.
Fieldbus: A family of industrial networks that connect controllers to field devices, such as PROFIBUS, FOUNDATION Fieldbus and Modbus RTU over serial links. Serial fieldbuses are often reached through serial to Ethernet gateways, which extends network reach to devices that were never designed for it. See the Industrial Switch and Serial Gateway Hardening Guide.
Firmware: The embedded software that runs a controller, drive or network device. Malicious firmware can survive logic reloads, so firmware integrity checks and controlled update procedures matter. ATT&CK for ICS covers related behaviour as T0800 Activate Firmware Update Mode and T1693 Modify Firmware. See the Firmware and Boot Security Guide.
Foundational requirements (FR): The seven groups that organise IEC 62443-3-3 and 4-2 technical requirements: FR 1 Identification and authentication control, FR 2 Use control, FR 3 System integrity, FR 4 Data confidentiality, FR 5 Restricted data flow, FR 6 Timely response to events and FR 7 Resource availability. Security levels are expressed per FR as a vector. See the IEC 62443-3-3 and 4-2 Security Levels Guide.
FrostyGoop: ICS malware that, as described in MITRE ATT&CK (S1165), reads and writes holding registers on devices over Modbus TCP port 502. It showed that a simple tool using a standard protocol can disrupt heating services. See the FrostyGoop Modbus Malware Guide.
Golden image: A verified, known good copy of a system or controller configuration (operating system image, application install, PLC program and settings) kept offline for recovery. Restoring from golden images is often faster and safer than cleaning an infected HMI or SCADA server. See the OT Backup, Recovery and Golden Image Guide.
HAZOP: Hazard and operability study: a structured, team based review of a process design that asks how deviations (more flow, less pressure, reverse flow) could cause hazards and which safeguards prevent them. Cyber PHA extends the method to deliberate manipulation. See the Safety and Security Co-engineering Guide.
Human-machine interface (HMI): NIST SP 800-82 Rev. 3 defines it as the hardware or software through which an operator interacts with a controller, from a simple button panel to an industrial PC running HMI software. Windows based HMIs are a frequent target and are covered by ATT&CK for ICS techniques such as T0823 Graphical User Interface. See the HMI and SCADA Server Hardening Guide.

I

ICS advisory: A published notice of a vulnerability in an industrial product, typically giving affected versions, CVSS scores, vendor fixes and workarounds. National agencies and vendors publish them; the asset owner's job is to triage them against the installed base and decide between patching, mitigation and monitoring. See the ICS Advisory Triage and OT Vulnerability Management Guide.
IEC 61511: The international functional safety standard for safety instrumented systems in the process industry, adopted in the United States as ANSI/ISA-61511. It expects a security risk assessment of the SIS, which ties it to IEC 62443. See the Safety Instrumented Systems Security Guide.
IEC 62443: The ISA/IEC 62443 series of standards for the security of industrial automation and control systems. ISA lists parts covering terminology and models (1-1), asset owner programmes (2-1), patch management (TR 2-3), service providers (2-4), risk assessment for system design (3-2), system security requirements and security levels (3-3), secure product development (4-1) and component requirements (4-2). See the IEC 62443 Guide.
Industrial automation and control system (IACS): The IEC 62443 term for the people, hardware, software and policies involved in operating an industrial process. It is broader than ICS because it includes the procedures and organisation around the technology. See the IEC 62443 Guide.
Industrial control system (ICS): The control systems that run industrial processes: SCADA, DCS, PLCs, RTUs, safety systems and their supporting servers. NIST SP 800-82 Rev. 3 treats ICS as one part of the wider category of operational technology. See the IT Security vs OT Security.
Industrial DMZ: A demilitarised network between the enterprise and the control network, often labelled Purdue Level 3.5. NIST SP 800-82 Rev. 3 recommends a DMZ so that traffic does not pass directly between corporate and OT networks; replicated historians, patch servers and remote access brokers sit here. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Industrial IoT (IIoT): Internet connected sensors, gateways and edge devices that collect plant data, often sending it to cloud analytics platforms. IIoT creates new paths from the plant floor to the internet that bypass traditional Purdue boundaries. See the Industrial IoT (IIoT) Security Guide.
Industroyer: Malware framework, described in MITRE ATT&CK (S0604), built to affect electrical substation equipment and used in the attack on the Ukrainian power grid in December 2016. Industroyer2 (S1072), assessed as designed for high voltage substations, communicates over IEC 60870-5-104. See the ICS Malware History Guide.
INCONTROLLER (PIPEDREAM): Modular ICS malware described in MITRE ATT&CK (S1045) with modules for Schneider Electric and Omron PLCs and for OPC UA, Modbus and CODESYS. It can discover devices and download logic, and was disclosed before any reported destructive use. See the PIPEDREAM (INCONTROLLER) ICS Toolkit Guide.
Integrator: In IEC 62443, the party that designs, installs and commissions an automation solution from supplier products, and often maintains it. Integrators commonly hold remote access and shared engineering credentials, so their access is a major part of OT identity risk. See the OT Third-Party and Integrator Access Guide.

J to M

Jump host: A hardened intermediate server, usually in the industrial DMZ, through which all interactive remote sessions into OT must pass. Good jump hosts enforce multi factor authentication, session recording and approval workflows, and hold no standing credentials for controllers. See the OT Remote Access Guide.
Ladder logic: A graphical PLC programming language, standardised in IEC 61131-3 with function block diagram, structured text and others, that represents logic as relay rungs. Unexpected changes to ladder logic are the core risk that change detection and project file integrity checks address. See the PLC Security Guide.
Logic solver: The part of a safety instrumented system that receives sensor inputs and decides whether to trip final elements such as shutdown valves. NIST SP 800-82 Rev. 3, quoting ANSI/ISA-84.00.01, describes an SIS as sensors, logic solvers and final control elements. Triton targeted logic solvers directly. See the Safety Instrumented Systems Security Guide.
Loss of view and loss of control: Impacts in ATT&CK for ICS where operators can no longer see (T0829 Loss of View) or command (T0827 Loss of Control) the process. Denial of view and manipulation of view (T0832) are related techniques where the screen shows false or frozen values. See T0829 Loss of View.
Loss of safety: An ATT&CK for ICS impact (T0880) where safety functions are disabled or degraded so that the process can reach an unsafe state. It is the outcome that safety and security co-engineering exists to prevent. See MITRE ATT&CK for ICS T0880 Loss of Safety.
Management of change (MOC): The plant procedure that reviews and approves changes to process equipment, software and configuration before they are made. Adding cyber checks to MOC (firewall rules, accounts, remote access, logic changes) keeps security records current. See OT Management of Change for Cyber.
Maturity level (ML): In IEC 62443, a measure of how well defined and consistently followed a process is, used in the asset owner programme (2-1), service provider (2-4) and product development (4-1) parts. It is separate from security level, which measures technical capability. See the OT Security Maturity Model.
Modbus: A simple master and slave (client and server) protocol dating from 1979, still very widely used. Modbus TCP uses port 502 and has no authentication: any client that can reach a device can read and write its registers and coils. Allowlisting of clients and function codes is the usual protection. See the Modbus TCP and Modbus Security Guide.

N to P

NERC CIP: The North American Electric Reliability Corporation Critical Infrastructure Protection standards: mandatory and enforceable cyber security requirements for registered entities that operate the bulk electric system, covering asset categorisation, electronic security perimeters, access, patching and supply chain. See the NERC CIP Guide.
NIST SP 800-82: The NIST Guide to Operational Technology (OT) Security. Revision 3, published in September 2023, defines OT as programmable systems and devices that interact with the physical environment and covers ICS, building automation, transportation and physical access control systems. As of November 2026 NIST lists an initial public draft of Revision 4 open for comment. See the NIST SP 800-82 OT Security Guide.
Network security monitoring (NSM) for OT: Passive capture and analysis of control network traffic, usually from switch SPAN ports or taps, with parsers for industrial protocols. It detects new devices, unexpected writes, program downloads and mode changes without touching fragile endpoints. See the OT Network Security Monitoring Guide.
OPC UA: OPC Unified Architecture, a platform independent industrial interoperability standard (IEC 62541) with built in security modes for signing and encryption, application instance certificates and user authentication. The binary protocol commonly uses TCP port 4840. Security mode None is still found in the field. See the OPC UA Security Guide.
Operational technology (OT): NIST SP 800-82 Rev. 3 defines OT as programmable systems or devices that interact with the physical environment, or manage devices that do. Its priorities differ from IT: safety and availability come first, assets last decades and change windows are rare. See the OT Security Guide.
OT asset inventory: A maintained record of every controller, HMI, server, network device and field device, with firmware versions, location, criticality and owner. It is the foundation for vulnerability triage, segmentation and incident response. See the OT Asset Register Template.
Passive asset discovery: Identifying OT assets by listening to network traffic rather than scanning. It avoids the risk that active scans crash older controllers. Selective active queries using native protocols can fill gaps once tested. See the OT Asset Visibility Guide.
PID control: Proportional, integral and derivative control: the standard feedback algorithm that adjusts an output (a valve position) to hold a process variable (a temperature) at a setpoint. Tampering with PID tuning or setpoints is a subtle form of manipulation of control. See MITRE ATT&CK for ICS T0836 Modify Parameter.
Programmable logic controller (PLC): NIST SP 800-82 Rev. 3, quoting the ISA dictionary, defines a PLC as a solid state control system with user programmable memory for instructions that implement functions such as I/O control, logic, timing, counting, PID control, communication and arithmetic. PLCs sit at Purdue Level 1. See the PLC Security Guide.
Product supplier: In IEC 62443, the manufacturer of automation components or systems. IEC 62443-4-1 sets its secure development lifecycle requirements and 62443-4-2 the technical requirements for components. Buyers can ask for these in procurement. See the OT Product Procurement Guide.
PROFINET: An industrial Ethernet standard from PROFIBUS and PROFINET International, common in manufacturing with Siemens and other controllers. Real time traffic runs at Layer 2, so it is protected mainly by segmentation and switch hardening. See the Industrial Protocol Security Guide.
Program download and upload: Transferring control logic to a controller (download, ATT&CK for ICS T0843) or reading it from one (upload, T0845). Both are normal engineering tasks, so monitoring should tie each one to an approved change. See MITRE ATT&CK for ICS T0843 Program Download.
Purdue model: The Purdue Enterprise Reference Architecture applied to security: Level 0 physical process, Level 1 basic control, Level 2 supervisory control, Level 3 site operations, Level 3.5 industrial DMZ, Levels 4 and 5 enterprise. It describes where assets sit; zones and conduits specify which flows are allowed. See Purdue Model vs Zero Trust for OT.

R to S

Remote terminal unit (RTU): NIST SP 800-82 Rev. 3 describes an RTU as a computer with radio interfacing used in remote situations where wired communication is unavailable, typically communicating with remote field equipment; PLCs with radios are sometimes used instead. RTUs are common at substations, pump stations and pipelines. See the OT Security Guide.
Risk assessment (IEC 62443-3-2): The process that partitions the system under consideration into zones and conduits, assesses initial and residual risk, and assigns a target security level to each. Its outputs drive design and procurement. See the IEC 62443-3-2 OT Risk Assessment Guide.
S7comm: The proprietary Siemens protocol used by SIMATIC S7 controllers and engineering tools, carried over ISO on TCP port 102. Newer firmware supports protected communication and access levels; older variants accept commands from any reachable client. See the Siemens SIMATIC S7 and TIA Portal Hardening Guide.
Safety instrumented function (SIF): A single safety function implemented by an SIS, such as closing a feed valve on high pressure, with a required safety integrity level. A compromised SIF may fail to act on demand or trip spuriously. See the Safety Instrumented Systems Security Guide.
Safety instrumented system (SIS): NIST SP 800-82 Rev. 3, quoting ANSI/ISA-84.00.01, describes an SIS as sensors, logic solvers and final control elements that bring a process to a safe state when predetermined conditions are violated; other names include emergency shutdown system. See the Safety Instrumented Systems Security Guide.
Safety integrity level (SIL): A functional safety measure (SIL 1 to SIL 4) of the risk reduction a safety function must deliver, from IEC 61508 and IEC 61511. It is not the same as an IEC 62443 security level, though both scales run to four. See the Safety and Security Co-engineering Guide.
SCADA: Supervisory control and data acquisition. NIST SP 800-82 Rev. 3 describes it as a generic name for a computerised system that gathers and processes data and applies operational controls over long distances, typical of power transmission, distribution and pipelines. See the HMI and SCADA Server Hardening Guide.
Secure by Demand: A procurement approach, promoted by government agencies including CISA, in which OT owners ask suppliers for security properties such as secure defaults, logging, strong authentication and vulnerability handling before buying. See the OT Product Procurement Guide.
Security level (SL): The IEC 62443 scale for the attacker a zone, conduit or component is designed to resist: SL 1 casual or coincidental violation, SL 2 to SL 4 intentional violation with increasing means, resources, IACS specific skills and motivation. Levels are set per foundational requirement and come in target, capability and achieved forms. See the IEC 62443-3-3 and 4-2 Security Levels Guide.
Service provider: In IEC 62443-2-4, an organisation that supports the integration or maintenance of an automation solution for the asset owner. The part sets capability requirements for areas such as remote access, account management and patching. See the OT Third-Party and Integrator Access Guide.
Stuxnet: Described by MITRE ATT&CK (S0603) as the first publicly reported malware to specifically target ICS devices, using multiple zero day vulnerabilities, a Windows rootkit and network infection routines. It modified PLC logic while showing operators normal values, the template for manipulation of view. See the ICS Malware History Guide.
System under consideration (SuC): In IEC 62443-3-2, the defined scope of the IACS being assessed, including its boundaries and all access points. Getting the SuC right, including remote access and IT dependencies, decides whether the risk assessment is meaningful. See the IEC 62443-3-2 OT Risk Assessment Guide.

T to Z

Tag: A named data point in a control system, such as a pressure reading or a pump start command, mapped to a controller register. Attackers map tags to understand a process (ATT&CK for ICS T0861 Point and Tag Identification). See T0861 Point & Tag Identification.
Target security level (SL-T): In IEC 62443, the security level required for a zone or conduit, set by the 62443-3-2 risk assessment. Tenders should state SL-T per foundational requirement rather than a single number. See the IEC 62443-3-2 OT Risk Assessment Guide.
Transient cyber asset: A laptop, USB drive or test device connected to the control network for a short time, typically by maintenance staff or contractors. ATT&CK for ICS covers its use for initial access as T0864, and NERC CIP sets specific requirements for transient cyber assets and removable media. See T0864 Transient Cyber Asset.
Triton (TRISIS): An attack framework, described in MITRE ATT&CK (S1009), built to interact with Triconex safety instrumented system controllers. It is the best known case of malware aimed at a safety system rather than the control system. See the Safety Instrumented Systems Security Guide.
Vendor remote access: Connections from suppliers and integrators into OT for support and maintenance. Good practice routes every session through a brokered path in the DMZ with individual accounts, multi factor authentication, time limited approval and recording, replacing always on modems and shared VPN accounts. ATT&CK for ICS T0822 External Remote Services describes the abuse. See the OT Remote Access Guide.
Zero trust for OT: Applying zero trust principles (verify every request, least privilege, continuous evaluation) to OT, usually at the boundaries and for remote and user access rather than inside Level 0 and 1 where devices cannot authenticate. See Purdue Model vs Zero Trust for OT.
Zone: In IEC 62443, a grouping of logical or physical assets that share common security requirements. IEC 62443-3-2 requires business and control system assets to be in separate zones and safety related assets to be separated, and each zone gets a target security level. See the OT Zones and Conduits Worksheet Template.

For identity, IAM and non-human identity terms, see the NHI and IAM Glossary. Related NHI Mgmt Group resources: OT Security Guide · OT Security Standards Compared · IEC 62443 Guide · OT and ICS Identity and Access Guide

OT and ICS Security Glossary: Plain Definitions from PLC to IEC 62443 Zones

A