# MITRE ATT&CK for ICS: Using the Matrix for Threat-Informed OT Defense > ATT&CK for ICS gives OT teams a shared catalog of adversary behavior, so detection and control gaps can be tested against plausible scenarios instead of… - Canonical URL: https://wiki.aspotomasyon.com/article/mitre-attack-for-ics-threat-informed-defense - Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki) - Category: Industrial Cybersecurity - Published: 2026-10-11 · Updated: 2026-10-11 - Reading time: 8 min · Language: English ATT&CK for ICS gives OT teams a shared catalog of adversary behavior, so detection and control gaps can be tested against plausible scenarios instead of generic IT lists. ![MITRE ATT&CK for ICS: Using the Matrix for Threat-Informed OT Defense — Map the zone → Select entries → Test the gaps → Close and recheck.](https://wiki.aspotomasyon.com/assets/diagrams/mitre-attack-for-ics-threat-informed-defense.svg) *MITRE ATT&CK for ICS: Using the Matrix for Threat-Informed OT Defense — Map the zone → Select entries → Test the gaps → Close and recheck.* Most OT security programs start with an inventory and a list of controls. What they often lack is a structured way to ask which adversary behaviors those controls would actually catch. The MITRE ATT&CK matrix for industrial control systems provides that structure: a published catalog of tactics and techniques relevant to industrial control systems, organized by the goal an adversary is trying to reach. This article explains how to use the matrix defensively. It covers mapping behaviors onto assets and zones, finding detection gaps, prioritizing them through credible scenarios, and connecting the results to monitoring, segmentation, backup, and incident response. It contains no exploit steps. Read the matrix as planning vocabulary. It is not a compliance checklist, and it does not replace a risk assessment. ## What the ICS matrix contains The ICS matrix lists twelve tactics, each describing an adversary goal, with techniques grouped under each one. The tactics run from Initial Access through Execution, Persistence, Privilege Escalation, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Inhibit Response Function, Impair Process Control, and Impact. The later tactics describe effects on control functions and on the process itself, which is the vocabulary OT teams need when they talk about availability and safe operation. The table shows how individual entries translate into questions a plant team can answer. The entry names are taken from the matrix, and the questions are written for a defensive review. | Matrix entry | What it describes | Question for your site | | --- | --- | --- | | Valid Accounts | Use of legitimate credentials to log in | Which accounts can log in to engineering stations, and are they unique and reviewed? | | External Remote Services | Entry through services reachable from outside the zone | Which remote services exist, who approves them, and where are their sessions logged? | | Default Credentials | Use of factory or unchanged credentials on devices | Which devices still use vendor defaults, and where is the change record? | | Program Download | Retrieval of controller logic or configuration | Can a download be detected, and is an approved baseline kept for comparison? | | Modify Controller Tasking | Change to what a controller is directed to do | Which tasking changes are logged, and are they reviewed against change records? | ## Map the matrix to your assets and zones Mapping starts from the inventory, not from the matrix. For each zone, list the asset classes it contains, such as engineering workstations, HMIs, historians, PLCs, drives, and remote access servers, along with the data flows that cross its boundary. Only then choose the matrix entries that apply to each asset class. An entry with no asset to act on is a planning note, not a finding. The [OT asset inventory guide](https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery) describes how to build the baseline this step needs. - **Asset class:** the device type and its role in the process. - **Zone and conduit:** where the asset sits and which flows reach it. - **Access path:** how people and services reach it, including vendor and maintenance paths. ## Run a detection-gap analysis A detection gap exists where a preventive control may fail and no evidence reaches a person who can act. The analysis below works zone by zone, so that the output can be assigned and tested. The gap register keeps the result in a form that reviewers can challenge line by line. 1. **Pick one zone and its highest-consequence assets first.** A small, well-understood scope is more useful than a full matrix review that never finishes. 2. **Select plausible entries.** For each asset class, choose the matrix entries that fit the zone's access paths and its real operating conditions. 3. **Record the controls and the evidence.** For each entry, note the preventive control, the detection source such as a log, a network sensor, or a process alarm, and whether that evidence reaches a responder. 4. **Mark gaps.** A gap exists where a control is missing, or where a source exists but its output is never reviewed. 5. **Assign an owner and a closure test.** Each gap needs a named owner and a test that shows the gap is closed. **Illustrative example** Assume a bottling line whose engineering workstation sits in a cell zone and is reached through a vendor gateway in a DMZ. The workstation uses shared named accounts and logs only locally. Mapping the matrix suggests Valid Accounts and External Remote Services as plausible entries. The gap register records no central login events and no session logs. The first fix is unique accounts with logs forwarded to monitoring, followed by a restore test of the engineering project files. The result is then checked with an approved simulation. The site, its details, and the outcome are assumptions for illustration. ## Prioritize with credible scenarios A matrix with many entries cannot be tested in full, so rank the gaps. Consequence comes from the risk assessment: loss of production, safety impact, environmental release, or equipment damage. Plausibility comes from the access paths that actually exist and from published reporting about each entry. The [ICS risk assessment](https://wiki.aspotomasyon.com/article/ics-risk-assessment) provides the consequence side. Write each scenario as one sentence: who could reach which asset, through which path, with what effect, and which control would stop it or reveal it. A scenario that cannot be written this way is not yet credible enough to drive spending. ## Use public incident analyses at a high level Public analyses of incidents against industrial systems help decide which entries to test first and whether current controls would have revealed a similar pattern. Record only the category of behavior and the control lesson, such as a missing log source or an unmonitored path. Do not copy technical exploit detail into internal wikis or tickets. The defensive question is what your site would have seen. The ATT&CK site lists groups, software, and campaigns beside the matrix, which gives a starting point for finding the public sources behind an entry. ## Connect findings to monitoring, segmentation, backup, and response Each gap that needs detection becomes a sensor, a log source, or an alert rule. NIST SP 800-82 Rev. 3 states that firewall rulesets should permit only connections between adjacent levels, tiers, or zones, and that boundary devices between zones do not stop lateral movement inside a zone. Gaps inside a zone therefore need host and account controls, not only boundary rules. The NIST page lists Rev. 3 (September 2023) as the final edition; check it for later revisions and record which edition you cite. See [OT network monitoring](https://wiki.aspotomasyon.com/article/ot-network-monitoring) and [industrial firewalls and IDS](https://wiki.aspotomasyon.com/article/industrial-firewalls-ids) for the deployment side. - **Backup.** NIST recommends testing restoration from backup data and keeping copies that the same incident cannot destroy. Tie the restore test to the entries that affect controller logic. - **Response.** Every high-consequence entry needs a playbook in [ICS incident response and recovery](https://wiki.aspotomasyon.com/article/ics-incident-response-recovery) , with named people who can act outside office hours. ## Apply this to your project - Zone and asset inventory completed before any matrix entry is mapped to a site. - Each selected entry recorded for a zone with the reason it is plausible at that site, and excluded entries noted with reasons. - Gap register kept with preventive control, detection evidence, owner, and closure test for every gap. - Remote and vendor access paths confirmed to log centrally, with the logs reaching a responder. - Restoration of controller logic and configuration from backup tested, and the result recorded. - Register reviewed at a set interval and after every significant change to a zone or access path. [Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance. ## Frequently asked questions ### What is MITRE ATT&CK for ICS? It is a public matrix maintained by MITRE that lists tactics and techniques associated with adversary behavior against industrial control systems. Tactics describe the adversary goal, and each tactic lists techniques. Teams use it as shared vocabulary for mapping controls, detection, and gaps. It describes behaviors rather than complete procedures, and it does not certify any product or site. ### Is ATT&CK for ICS a compliance framework? No. The matrix describes observed adversary behavior. It does not set requirements that an auditor can check, and it does not replace a risk assessment or a standard such as IEC 62443. Use it to decide which controls and detections to test, then record those decisions in your normal governance records. ### Do I need to cover every technique in the matrix? No. Select the entries that are plausible for each zone's access paths and consequences, and document why the others were excluded. A short, justified list is more useful than a complete table that nobody maintains. ### How often should the gap analysis be updated? Update it when a zone, access path, vendor connection, or asset class changes, and review it at an interval set by your governance process. The matrix is published in versions, so record the version you used, which lets the analysis be repeated later. ### Can ATT&CK for ICS show that an attack has happened? Not by itself. It is a planning and mapping tool. Evidence of activity comes from logs, network monitoring, and process data reviewed by people who know the normal baseline. The matrix helps decide which of those sources must exist and who must review them. ## Continue the engineering work - [OT Network Monitoring and Anomaly Detection](https://wiki.aspotomasyon.com/article/ot-network-monitoring) - [ICS Security Risk Assessment Methodology (IEC 62443-3-2)](https://wiki.aspotomasyon.com/article/ics-risk-assessment) - [ICS Incident Response and Recovery](https://wiki.aspotomasyon.com/article/ics-incident-response-recovery) - [Industrial Firewalls and Intrusion Detection Deployment](https://wiki.aspotomasyon.com/article/industrial-firewalls-ids) - [OT Asset Inventory and Network Discovery](https://wiki.aspotomasyon.com/article/ot-asset-inventory-network-discovery) Browse the [related technical library](https://wiki.aspotomasyon.com/category/industrial-cybersecurity) or follow an [ASP project guide](https://wiki.aspotomasyon.com/guides) to plan the implementation sequence. ![Conceptual access controls around an OT service. Actual zones, conduits, protections, and response actions require a site-specific assessment.](https://wiki.aspotomasyon.com/assets/diagrams/industrial-cybersecurity-context.svg) *Conceptual access controls around an OT service. Actual zones, conduits, protections, and response actions require a site-specific assessment.* ## Primary references and further reading Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results. - [MITRE ATT&CK — Matrix for ICS](https://attack.mitre.org/matrices/ics/) - [NIST — SP 800-82 Rev. 3 (final, September 2023), Guide to Operational Technology (OT) Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final) - [ISA — ISA/IEC 62443 Series of Standards](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards) --- Cite the canonical article: https://wiki.aspotomasyon.com/article/mitre-attack-for-ics-threat-informed-defense (MITRE ATT&CK for ICS: Using the Matrix for Threat-Informed OT Defense, ASP OTOMASYON, updated 2026-10-11).