9.4 Control-System Cybersecurity

NCEES PE Control Systems Engineering Exam Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Handbook, ISA-5.1, and IEC 61511 on Exam Day 1.3 CBT Strategy, AITs, Calculators, and Pacing

2 Process Measurement Sensors

2.1 Pressure, Level, and Temperature Sensors 2.2 Flow, Counter, and Motion Sensors 2.3 Analytical Instruments and Sampling Systems

3 Specialty Sensors and Characteristics

3.1 Fire and Gas Detectors 3.2 Machinery Monitoring and Protection 3.3 Sensor Characteristics: Accuracy, Calibration, and Dynamics

4 Selection, Installation, and Primary Calculations

4.1 Sensor Selection and Material Compatibility 4.2 Sensor Installation Details and Drawings 4.3 Flow Calculations 4.4 Level Calculations

5 Conversions, Thermowells, and Checkout

5.1 Process Measurement Unit Conversions 5.2 Thermowell Design and Wake Frequency 5.3 Sensor Testing and Commissioning

6 Drawings, Dynamics, and PID

6.1 P&IDs, Loop Diagrams, and ISA-5.1 Symbology 6.2 Process Dynamics and Loop Response 6.3 Feedback Control and PID

7 Advanced, Discrete, and Process Applications

7.1 Feedforward, Cascade, Ratio, Override, and Split-Range 7.2 Discrete and Sequential Control 7.3 Control of Common Process Equipment

8 HMI, Alarms, Logic, and Architecture

8.1 HMI, Displays, and Control-Room Layout 8.2 Alarm Management 8.3 IEC 61131-3 Logic Implementation 8.4 DCS, PLC, SCADA Architecture and Interfaces

9 Capacity, Testing, and Cybersecurity

9.1 Capacity, Availability, Heat Load, Power, and Environment 9.2 FAT, IST, SAT, and Commissioning 9.3 Performance Monitoring and Management of Change 9.4 Control-System Cybersecurity

10 Valve Type, Trim, Sizing, and Actuators

10.1 Valve Types and Materials 10.2 Valve Trim, Leakage Class, and Characteristics 10.3 Valve Sizing, Pressure Drop, and Split-Range 10.4 Actuators and Failure Modes

11 Fluid Dynamics, Accessories, and Relief Types

11.1 Cavitation, Flashing, Choked Flow, and Noise 11.2 Valve Accessories and Installation 11.3 Pressure-Relieving Device Types and Installation 11.4 Pressure-Relieving Device Calculations

12 Motors, Solenoids, Regulators, and Checkout

12.1 Motor Starters, VSDs, and Soft Starters 12.2 Solenoid Valves and Relays as Final Elements 12.3 Self-Regulating Devices 12.4 Final Element Testing and Commissioning

13 Signal Types and Conversion

13.1 Analog and Discrete Signal Types 13.2 Buses, Topologies, and Digital Protocols 13.3 Signal Conversion, I/P, Splitters, and Bit Precision

14 Hazardous Areas, Power, and Circuits

14.1 Hazardous-Area Methods and Intrinsic Safety 14.2 Power, Grounding, Segregation, and EMI 14.3 Two-Wire, Four-Wire, and Loop Calculations

15 Media and Network Architecture

15.1 Transmission Media: Copper, Fiber, Wireless 15.2 TCP/IP, OPC, Addressing, and Architectures 15.3 OPC, Network Addressing, and Segmentation

16 Lifecycle and Risk Allocation

16.1 IEC 61511 Lifecycle Structure and Phases 16.2 Hazard and Risk Assessment 16.3 LOPA, IPLs, and SIF Identification

17 SRS, Design, and SIL Calculations

17.1 Safety Requirements Specification 17.2 SIS Design, Device Selection, and Constraints 17.3 SIL Calculations and Formulas

18 SAT, Proof Testing, and MOC

18.1 Installation, Commissioning, Validation, and SAT 18.2 Operation, Proof Testing, Demands, and Bypasses 18.3 Modification, Decommissioning, and MOC

9.4 Control-System Cybersecurity

Key Takeaways Explain This Topic AI

IEC 62443 zone, conduit, and security-level ideas are professional practice for industrial automation; they are not treated here as a 2027 supplied exam standard.

A historian dual-homed to business and process networks is an uncontrolled conduit, not a clever wiring shortcut.

Monitoring (logs, alerts) does not replace protection (zones, allow-listed conduits, least privilege).

Untested patches on a running compressor DCS can themselves cause a trip; test, window, and use compensating monitoring until then.

Firewall rules, remote-access accounts, and firmware belong in the same MOC discipline as process changes; backups that were never restored are not backups.

Last updated: August 2026

Control-system cybersecurity on the PE exam is a public-safety and availability topic, not an invitation to imitate office IT. Knowledge area 2.G asks for management systems, risk assessments, security-level verification, MOC, monitoring, and protections. The job is to keep the process controllable and the SIS trustworthy. This section teaches defensive design and governance only . It does not describe attacks, payloads, or procedures for breaking into a system.

IEC 62443 (ISA/IEC 62443) is the usual professional language for industrial automation and control system (IACS) security: zones, conduits, foundational requirements, and security levels. For PE Control Systems 2027 study, treat those ideas as engineering practice . Do not assume the 62443 text is a supplied exam standard unless that year's NCEES design-standard sheet lists it. Answers should still sound like a licensed engineer: segment the system, limit privilege, verify the installed level against the target, and change it under MOC.

Management system, risk assessment, and security-level verification

A security management system is the governance wrapper: named roles (who may download, who may open a conduit), an asset inventory that includes controllers and not only PCs, a risk-assessment cadence, training, incident handling, audit, and MOC that covers cyber the same way it covers a bypass. Buying a firewall SKU is not a management system.

Risk assessment groups assets that share security needs into zones and names the allowed paths between them as conduits . A BPCS zone, an SIS zone, a site operations zone, and an enterprise zone should not be one flat network. The assessment sets a target security level (what the zone must achieve) based on consequence—safety, environmental, production—not based on whatever default the vendor shipped. Security-level verification then compares achieved architecture (what is installed and configured) with that target. Verification is evidence: allow-lists, account reviews, backup restore tests, remote-access logs, patch status. It is not a penetration hobby and it is not a SIL calculation; SIS integrity and IACS security interact, but a security-level claim does not replace IEC 61511 work.

Typical defensive patterns (Purdue-style levels as practice, not as a religion):

Field and basic control (levels 0–1) do not initiate sessions toward the enterprise.

Supervisory HMI and engineering (level 2) talk to controllers through designed conduits, not through ad hoc laptops.

Site operations and historians sit behind a DMZ or equivalent brokered path, not on both process and business LANs at once.

Enterprise users consume a replica or a brokered view, not a second network card in the process switch stack.

Protections, least privilege, remote access, backup

Protections enforce the architecture: allow-listed firewalls on conduits, unused services disabled, unique accounts, least privilege (operator logins do not get engineering download rights; service accounts are not domain-wide admins on controllers), physical access control to cabinets, portable-media policy, and SIS kept as independent as the design claims. Least privilege is also a FAT item: prove that the operator account cannot change firmware.

Remote access , when the plant needs vendor support, is a designed conduit: a jump host or equivalent broker in a DMZ, multi-factor authentication, time-bounded accounts, session logging, and a person who can revoke access when the call ends. Direct inbound paths to controllers from the public internet, or a standing vendor path that nobody reviews, are not 'support.' They are unmanaged conduits.

Backup and restore are protections for availability, including after ransomware or a bad download. A backup that has never been restored is a hope. Practice restore on an offline replica; keep an offline or otherwise protected copy of configurations, not only a virtual-machine snapshot of an HMI; include controller images, not only Windows boxes. Restore time belongs in the same conversation as MTTR in the capacity section.

Patching versus availability

Office IT can often patch a laptop the day a bulletin lands. A running compressor DCS cannot. An untested operating-system or firmware change can itself stop a scan, break a driver, or fail a redundant switchover. The professional sequence is: inventory what you run, read the vendor applicability note, test on a replica or in a windowed FAT-like regression, schedule a maintenance window, and until then apply compensating monitoring and access restriction on that zone. Refusing all patches forever is also a risk; the point is that availability is a security requirement in IACS (resource availability in 62443 language), so the patch is a change, not a reflex.

MOC and monitoring versus protection

Firewall rule changes, new remote users, new historian interfaces, and firmware are MOC —the same discipline as a clamp or a bypass. If operations can add a business-network jack 'temporarily' to a process switch, your zone drawing is fiction.

Monitoring watches the conduits and accounts you already allowed: failed logins, new devices, backup-job failures, unusual engineering downloads, time-sync loss. Protection is what prevents the path. Monitoring without protection is a camera on an unlocked door. Protection without monitoring means you do not know when a rule failed or a new dual-homed host appeared. The exam will offer a log collector as a substitute for a zone firewall. It is not a substitute.

Worked example — dual-homed historian

A process historian is installed with one network interface on the BPCS network and one on the business LAN, no firewall, and wide file or OPC sharing so that accountants can 'just grab tags.' The intent is convenience. The architecture is a dual-homed host : a single computer that is a member of two zones at once. That host is a conduit, and it is not a designed, allow-listed conduit. A compromise on the business network can use the historian as a path onto the process network because the machine is already attached to both. You do not need an exotic technique for that to be a bad design; you need only one poorly governed host.

Defensive alternatives: put the historian (or a replica) in a DMZ; replicate outbound through a brokered, allow-listed conduit to a business-side copy; do not dual-home; use unique least-privilege accounts; monitor that conduit for unexpected connections; and run the interface change through MOC. A read-only business replica plus a locked-down process collector is slower to wire than a second NIC. It is the design that matches zone-and-conduit practice.

Control Typical safeguard
Zone boundary Allow-listed conduit; no dual-homed hosts between business and process
Remote access Jump host or broker, multi-factor authentication, time-bounded accounts, session log
Accounts Unique IDs; least privilege; operator accounts cannot download firmware
Patching Test on a replica; scheduled window; inventory of delayed patches with compensating monitoring
Backup / restore Tested restore; protected copy; controller configs, not only HMI disks
SIS independence Separate conduits and engineering procedures from BPCS; no casual shared laptops
Portable media Policy and a scanning station; disable unused ports where the listing allows
Cyber MOC Firewall rules, new accounts, new interfaces, and firmware use the same MOC gate as process changes

Exam traps: treating IEC 62443 as if it were automatically a supplied NCEES standard; treating a dual-homed historian as a networking convenience; treating logs as a replacement for segmentation; patching a live compressor controller the afternoon the bulletin arrives without a window.