MITRE ATT&CK for ICS, Explained
MITRE ATT&CK for ICS is the adversary behavior matrix for industrial control systems: eleven tactics from Initial Access through Impact, with techniques describing exactly how attacks against OT proceed.
In an RFP, technique coverage is the difference between a firm that has rehearsed the attack paths in your environment and a firm that will encounter them for the first time on your retainer.
What renders on this page
- ▸Verified firm matrix filtered by MITRE ATT&CK for ICS coverage
- ▸Case-study technique records (T0861, T0883, T0801, T0886) from real engagements
- ▸Purdue Model level mapping per firm
- ▸"Request Secure RFP" form pre-wired to the OT/ICS RFP template
What the matrix covers
ICS-specific techniques across tactics like Inhibit Control Function, Manipulate I/O, and Damage Control Process, the OT-native outcomes IT matrices do not model. Coverage claims are checkable: a firm claiming response depth should record techniques from actual engagements.
Technique coverage in the RFP
The OT/ICS RFP template asks for technique coverage by phase (detection, response, forensics) so gaps show up before the incident. Directory case records carry the techniques each engagement actually involved, making coverage claims auditable.
How case records use it
Anonymized cases record technique identifiers alongside response and containment times: refinery ransomware involving T0861 and T0883, chemical plant malware contained in the DMZ before process impact. Technique data turns narrative case studies into comparable evidence.
Find ATT&CK for ICS-capable firms
Filter the OT/ICS directory by mitre-ics alignment; every verified OT firm in the directory carries recorded technique coverage from live engagements.
Frequently asked questions
Is MITRE ATT&CK for ICS the same as the enterprise matrix?
No, it is a separate matrix with ICS-specific tactics and techniques reflecting how OT attacks actually proceed: safety system manipulation, controller reprogramming, physical process damage. Enterprise coverage does not substitute.
What does technique coverage mean in practice?
That a firm has detection engineering, playbooks, and forensic procedures for the specific behaviors, a claim the directory verifies against engagement records rather than accepting from marketing.
How do I specify ATT&CK coverage in an RFP?
The OT/ICS RFP template lists techniques as structured selections by phase, no free text, so responses compare cleanly across firms.