What is ICS (Industrial Control Systems)?
ICS (Industrial Control Systems) is the collective term for the control systems, such as SCADA, DCS and PLC-based installations, that automatically measure, control, monitor and operate industrial processes. An ICS combines electrical, mechanical, hydraulic and pneumatic components with software to achieve an industrial objective, such as manufacturing a product, treating drinking water or transporting energy. ICS are found wherever physical processes are digitally controlled: in factories, power plants, water treatment works, pipelines, tunnels and locks. Because a failure has immediate physical consequences, availability and safety always come first in an ICS.
🧱 What types of ICS are there?
In NIST SP 800-82, the US NIST distinguishes three main types, complemented by the safety systems found in almost every process plant:
| Type | Function | Scale | Typical sector |
|---|---|---|---|
| SCADA (Supervisory Control And Data Acquisition) | Central supervision and remote operation | Geographically dispersed, tens to hundreds of km | Water, energy, pipelines |
| DCS (Distributed Control System) | Integrated process control with control loops | One site, continuous process | Chemicals, oil and gas, pharma |
| PLC-based systems | Local machine and line control | One machine, line or plant section | Discrete manufacturing, packaging |
| SIS (Safety Instrumented System) | Brings the process to a safe state when a hazard occurs | Independent of the basic control system | Process industry, oil and gas |
In practice the boundaries blur: a modern PLC installation may have a SCADA layer, and a DCS often contains PLCs for specific machines. An SIS runs on a certified safety PLC and falls under IEC 61511.
🔧 What components make up an ICS?
An ICS consists of a chain of components running from the field to the control room:
| Component | Description |
|---|---|
| Sensors and actuators | Measure pressure, temperature and level, and drive valves, pumps and motors |
| PLC (Programmable Logic Controller) | Controls machines and processes based on measured values, with scan cycles of a few to several tens of milliseconds |
| RTU (Remote Terminal Unit) | Rugged controller for remote sites, communicates with SCADA via, for example, DNP3 or IEC 60870-5-104 |
| IED (Intelligent Electronic Device) | Protection and metering relays in substations, often based on IEC 61850 |
| HMI (Human Machine Interface) | Operator screen |
| Historian | Stores process data long-term for trending and analysis |
| Engineering Station | Workstation used to program and configure the controllers |
| Communication | Fieldbuses, Industrial Ethernet and protocols such as Modbus, PROFINET and OPC UA |
🧠 What does an ICS do?
An ICS works in a closed control loop: measure, compare with a setpoint, adjust and measure again. In concrete terms:
- Collecting data - reads values from sensors and field devices
- Controlling - drives actuators to keep the process within limits, for example with a PID controller
- Automating - executes fixed sequences such as dosing, mixing, heating or starting up a line
- Monitoring and alarming - gives operators real-time insight and warns of deviations
- Protecting - intervenes through interlocks and an SIS in hazardous situations
The control layer responds in milliseconds; the supervisory layer (SCADA, HMI) typically works with refresh rates of a second or more.
🔄 What is the difference between ICS, OT and IACS?
The terms are often used interchangeably, but they differ in scope:
| Term | Meaning | Scope | Used in |
|---|---|---|---|
| ICS | Industrial Control Systems | Control systems for industrial processes | NIST, CISA, industry practice |
| OT | Operational Technology | Broader: also building automation, transport, physical access control | NIST SP 800-82 Rev. 3 |
| IACS | Industrial Automation and Control Systems | Systems plus the people, procedures and policies around them | IEC 62443 |
ICS is therefore a subset of OT. That is also why NIST changed the title of SP 800-82 in Rev. 3 (September 2023) from Guide to Industrial Control Systems (ICS) Security to Guide to Operational Technology (OT) Security. The differences with office IT are covered in the differences between IT and OT.
🏭 How is an ICS architecture structured?
Most ICS architectures are described using the Purdue Model, which also underpins ISA-95 and the automation pyramid:
- Level 0 - the physical process with sensors and actuators
- Level 1 - basic control: PLCs, RTUs, DCS controllers and the SIS
- Level 2 - supervision: SCADA, HMI and operator stations
- Level 3 - operations management: historian, MES and engineering
- Level 3.5 - the industrial DMZ as a buffer between OT and IT
- Levels 4–5 - the business network, ERP and the internet
Practical examples include the control of a drinking water treatment plant, the operation of an oil pumping station, monitoring energy consumption in a factory and driving conveyors and robotic arms.
🔐 Why is ICS security different from IT security?
ICS are often connected to IT networks but contain vulnerable equipment that was originally not designed with cybersecurity in mind. An ICS typically stays in service for 10 to 15 years and sometimes well over 20, often runs on legacy systems, cannot simply be restarted to install a patch, and uses protocols such as Modbus without authentication or encryption. The priority is availability and safety, not confidentiality, which shapes every aspect of ICS security.
Well-known attacks show what is at stake:
| Year | Attack | Target and effect |
|---|---|---|
| 2010 | Stuxnet | Siemens PLCs at Iran’s Natanz enrichment plant; centrifuges damaged |
| 2015 | BlackEnergy | Ukrainian power distribution companies; around 225,000 customers lost power |
| 2016 | Industroyer | Substation near Kyiv; malware spoke grid protocols directly |
| 2017 | TRITON | Safety instrumented system of a petrochemical plant in Saudi Arabia |
| 2021 | Colonial Pipeline | Ransomware on IT; pipeline shut down as a precaution |
| 2022 | PIPEDREAM | Attack toolkit for Schneider Electric and Omron PLCs, discovered before deployment |
| 2024 | FrostyGoop | Modbus commands to heating controllers in Lviv; 600 apartment buildings without heat |
Attack techniques against ICS are mapped in MITRE ATT&CK for ICS.
🛠️ How do you secure an ICS in practice?
A practical approach follows the steps of IEC 62443 and NIST SP 800-82:
- Inventory - build a complete asset inventory of controllers, firmware versions and connections
- Segment - apply network segmentation using the zones and conduits model and place a DMZ between IT and OT
- Restrict access - route remote access only through a jump server with MFA
- Monitor - use passive network monitoring that understands industrial protocols
- Manage vulnerabilities - follow ICS advisories and plan patch management around maintenance shutdowns
- Practise recovery - keep offline backups of PLC programs and configurations and test the incident response plan
| Standard or source | Role for ICS |
|---|---|
| IEC 62443 (ISA/IEC, developed by ISA99 since 2002) | International series of standards for IACS security, from policy to component |
| NIST SP 800-82 | Free US guide to OT and ICS security |
| IEC 61511 | Functional safety of SIS in the process industry |
| CISA ICS advisories | Vulnerability notices per vendor (numbered ICSA-YY-DDD-NN) |
| NIS2 and the Dutch Cybersecurity Act | Legal duty of care and incident reporting for essential and important entities |
In the Netherlands, the Cyberbeveiligingswet (Cybersecurity Act), the Dutch implementation of NIS2, has been in force since 15 August 2026. Many ICS operators fall under it as critical infrastructure. The Dutch NCSC shares threat intelligence and advice with these sectors.
❓ Frequently asked questions
What does ICS stand for?
ICS stands for Industrial Control Systems. The term covers SCADA, DCS, PLC-based systems and the associated field devices, networks and software that control physical processes.
Is a PLC an ICS?
A PLC is a component of an ICS, not the whole system. An ICS consists of PLCs together with sensors, actuators, HMIs, networks and often a SCADA or DCS layer. A small machine control system with one PLC and an HMI is sometimes called a PLC-based ICS.
What is ICS-CERT?
ICS-CERT was the US Industrial Control Systems Cyber Emergency Response Team, which was merged into the NCCIC in 2017 and is now part of CISA. Since February 2023, ICS-CERT no longer exists as a separate name. CISA still publishes ICS advisories, numbered with the ICSA prefix.
What is the difference between ICS and SCADA?
SCADA is one type of ICS, focused on central supervision of geographically dispersed installations. ICS is the umbrella term, which also includes DCS, PLC-based systems and safety systems. Every SCADA system is an ICS, but not every ICS is SCADA.
Why are ICS vulnerable to cyberattacks?
ICS often stay in service for 10 to 15 years or longer, are rarely patched and use protocols without authentication. Through IT/OT convergence they are also increasingly connected to office networks and the internet. An attack on an ICS can therefore cause physical damage, outages or unsafe situations.
Which standard applies to ICS security?
The most important international standard for ICS security is IEC 62443, which uses the term IACS. Many organisations also use NIST SP 800-82 as a practical guide. In the EU, NIS2 and its national implementations, such as the Dutch Cyberbeveiligingswet, form the legal framework.
📌 In summary
ICS is the backbone of industrial automation: SCADA, DCS, PLCs and safety systems that automatically measure, control and monitor physical processes. They are critical to infrastructure, factories and installations, and their long lifespan and links to IT call for security based on IEC 62443, with segmentation, monitoring and well-planned OT convergence.