CYBRARY IEC 62443-3-2 zone and conduit assessment
The checklist, zone by zone
Each zone carries a protection profile: a target security level, the foundational requirements that level is argued from, and what has to hold for the zone to stay inside it. Underneath each requirement is the evidence the range produces — 11 of 16 requirement lines have a graded detection behind them, and the rest are printed as open.
Safety instrumented system
Protection profile
- — The key switch sits in RUN for the whole production run.
- — No force is active on an interlock, and no force survives a keep-alive.
- — A trip point reached is a trip taken — nothing suppresses it.
Out of profile: Any writable state on the safety controller during a run. The safety system is watched, never commanded.
FR2 — Use control
- Safety controller key switch reported in PROGRAM T0858 · safety-interlock-forced
FR3 — System integrity
- Force active on interlock IL-7, refreshed on a keep-alive T0878 · safety-interlock-forced
FR7 — Resource availability
- Pressure above trip point, trip suppressed by active force T0880 · safety-interlock-forced
Breach timeline recorded against this zone
- Execution — SIS-301 reports its key switch in PROGRAM rather than RUN. T0858 · safety-interlock-forced
- Inhibit Response Function — A force on interlock IL-7 is kept alive every half hour and the trip is suppressed. T0878 · safety-interlock-forced
- Impact — Vessel pressure climbs past the trip point and nothing trips. T0880 · safety-interlock-forced
Conduits: C-04 Z-CONTROL→Z-SAFETY
Line control zone
Protection profile
- — Every address speaking control protocol is in the asset register.
- — Write function codes come only from the panel that owns the process.
- — One master per controller, and the commanded value matches the trend.
Out of profile: A write the register cannot account for, or two masters contesting the same controller.
FR1 — Identification and authentication control
- Write function code from a host registered as read-only T0836 · unauthorized-setpoint-write
- Device identification read from an address not in the asset register T0846 · engineering-laptop-dual-homed
- Control protocol from an address with no asset-register entry T0848 · rogue-modbus-master
- Second interactive session on the panel while the operator is signed in T0859 · hmi-remote-session
FR2 — Use control
- Controller mode changed RUN to PROGRAM during a production run T0858 · firmware-push-in-run
- Two masters writing to the same controller T0855 · rogue-modbus-master
FR3 — System integrity
- Fill weight above tolerance on line 2 T0831 · unauthorized-setpoint-write
- HMI lost communications with the capper mid-transfer T0857 · firmware-push-in-run
- Duplicate address detected on the field VLAN T0830 · serial-gateway-spoof
FR6 — Timely response to events
- Setpoint moved twice within thirty seconds — faster than an operator works T0855 · unauthorized-setpoint-write
- Conveyor stop and start not initiated at the panel T0831 · hmi-remote-session
- Two answers for the same register, and they disagree T0856 · serial-gateway-spoof
FR7 — Resource availability
- Capper controller stopped answering its poll — line function unavailable T0814 · firmware-push-in-run
- Line setpoint changing to whichever master wrote last — operator control contested T0831 · rogue-modbus-master
- Reported value healthy while motor current says the pump has stopped T0832 · serial-gateway-spoof
Breach timeline recorded against this zone
- Impair Process Control — Write Single Register on 40021, twice inside thirty seconds. T0836 · unauthorized-setpoint-write
- Impact — Fill weight follows the written setpoint and product leaves specification. T0831 · unauthorized-setpoint-write
- Execution — PLC-204 changes mode from RUN to PROGRAM during production. T0858 · firmware-push-in-run
- Persistence — 218 blocks in flight while the HMI loses the capper entirely. T0857 · firmware-push-in-run
- Initial Access — An address with no entry in the asset register speaks control protocol. T0848 · rogue-modbus-master
- Impair Process Control — Coil writes that are perfectly well-formed and completely unauthorized. T0855 · rogue-modbus-master
Conduits: C-01 Z-CONTROL→Z-OPS · C-04 Z-CONTROL→Z-SAFETY
Site operations zone
Protection profile
- — The historian collects and never commands.
- — Batch records and archives are read inside a reporting window, at a familiar volume.
- — The engineering workstation is the licensed one, and program downloads come from it alone.
Out of profile: Bulk archive reads, a new egress destination, or a program download sourced anywhere else.
FR1 — Identification and authentication control
No graded detection in this zone stands as evidence yet.
FR4 — Data confidentiality
- Historian egress volume far above its nightly baseline T0882 · historian-exfil
FR6 — Timely response to events
- Bulk archive read outside any reporting window T0811 · historian-exfil
Breach timeline recorded against this zone
- Lateral Movement — A Level 3 host opens a control-protocol session straight onto Level 1. T0886 · unauthorized-setpoint-write
- Lateral Movement — A block transfer runs from the jump host, not the licensed workstation. T0843 · firmware-push-in-run
- Impact — Volume and destination the historian has never used before. T0882 · historian-exfil
Conduits: C-01 Z-CONTROL→Z-OPS · C-02 Z-OPS→Z-DMZ
Industrial DMZ
Protection profile
- — Every session from business IT terminates in the DMZ and is brokered onward.
- — The replica serves the reads; nothing reaches the plant behind it.
- — Remote access into the control room arrives by the sanctioned path or not at all.
Out of profile: A plant-side session with no matching DMZ leg — a conduit nobody declared.
FR1 — Identification and authentication control
No graded detection in this zone stands as evidence yet.
FR5 — Restricted data flow
- Plant-side host has no session through the OT DMZ T0822 · engineering-laptop-dual-homed
- Historian talking to a destination it has never used T0882 · historian-exfil
FR6 — Timely response to events
No graded detection in this zone stands as evidence yet.
Breach timeline recorded against this zone
- Collection — Bulk reads against the historian's own archive, out of hours. T0811 · historian-exfil
- Discovery — The historian's own interface is in promiscuous mode with no capture job to explain it. T0842 · historian-exfil
- Initial Access — A contractor account signs in to the jump host from outside, out of hours. T0822 · hmi-remote-session
- Lateral Movement — A second interactive session on the panel while the operator is signed in. T0859 · hmi-remote-session
Conduits: C-02 Z-OPS→Z-DMZ · C-03 Z-DMZ→Z-ENTERPRISE
Enterprise zone
Protection profile
- — Business IT is treated as untrusted by everything below it.
- — No office host holds an address on a plant network at the same time.
Out of profile: A dual-homed host, which is an undeclared conduit wearing a laptop.
FR1 — Identification and authentication control
No graded detection in this zone stands as evidence yet.
FR5 — Restricted data flow
No graded detection in this zone stands as evidence yet.
Breach timeline recorded against this zone
- Initial Access — One host holds a corporate session and a plant session in the same minute. T0822 · engineering-laptop-dual-homed
- Discovery — Read Device Identification against PLC-201 — discovery, not control. T0846 · engineering-laptop-dual-homed
Conduits: C-03 Z-DMZ→Z-ENTERPRISE
Zone identifiers, security levels and foundational requirements are the standard's. The mapping of range content onto them is ours and is offered for planning. Simulation only — nothing in the range executes.