What is ATT&CK for ICS?

ATT&CK for ICS is the MITRE matrix that documents adversary techniques against industrial control systems and operational technology, such as PLCs, SCADA, and safety systems. It includes tactics unique to OT, including Inhibit Response Function and Impair Process Control.

How does ICS ATT&CK differ from Enterprise ATT&CK?

Enterprise ATT&CK targets IT systems where confidentiality and data theft dominate. ICS ATT&CK targets physical processes, where the adversary's goal is often disruption, manipulation, or disabling safety functions. The tactics and impacts reflect that difference.

Which OT standards does Bidda crosswalk ICS techniques to?

Bidda maps ATT&CK for ICS techniques to IEC 62443, NIST SP 800-82, and NERC CIP, connecting each adversary behaviour to the operational-technology control obligation that addresses it.

MITRE ATT&CK for ICS: Defending Operational Technology |…

Adversary techniques against PLCs, SCADA, and safety systems, mapped to IEC 62443 and NERC CIP.

Why ICS Needs Its Own Matrix

Operational technology is not just IT in a factory. Programmable logic controllers, SCADA systems, distributed control systems, and safety instrumented systems control physical processes where availability and safety outrank confidentiality. An attacker's objective in these environments is often to disrupt or manipulate a process, not to steal records. ATT&CK for ICS captures behaviours that have no clean equivalent in the Enterprise matrix, which is why MITRE maintains it separately.

The ICS Tactics

The ICS matrix is organised into tactics that include Initial Access, Execution, Persistence, Privilege Escalation, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Inhibit Response Function, Impair Process Control, and Impact. Two of these are distinctive to operational technology. Inhibit Response Function covers techniques that prevent safety and protection systems from responding to a hazardous condition. Impair Process Control covers techniques that manipulate the physical process itself, such as modifying a setpoint or a control parameter (T0836).

Real Consequences

Techniques such as Denial of Service against a controller (T0814) or actions that cause a Loss of Availability (T0826) translate directly into stopped production, blacked-out grids, or disabled safety interlocks. The threat is informed by documented attacks on energy and industrial targets, which is part of why critical-infrastructure regulators now expect operators to demonstrate defences against these specific behaviours.

How Bidda Maps ATT&CK ICS

Bidda represents ICS techniques as verified nodes and crosswalks them to the standards that govern industrial security: IEC 62443 for industrial automation and control systems, NIST SP 800-82 for OT security, and NERC CIP for the bulk electric system in North America. For an operator, this turns an ICS technique into a concrete obligation: a technique that impairs process control maps to the segmentation, monitoring, and integrity requirements that the relevant standard mandates.

Bridging IT and OT Governance

Most critical-infrastructure organisations must satisfy both IT and OT security expectations. Because Bidda holds Enterprise, Mobile, and ICS techniques in one registry with a shared crosswalk layer, a governance team can reason across the boundary, querying the ICS technique nodes through the API or MCP server and aligning them with the same control catalogue used for corporate IT. The official ICS matrix is published by MITRE at attack.mitre.org.

MITRE ATT&CK for ICS: Defending Operational Technology

Why ICS Needs Its Own Matrix

The ICS Tactics

Real Consequences

How Bidda Maps ATT&CK ICS

Bridging IT and OT Governance

Frequently Asked Questions

⚠ Important: Human Verification Required