Secure Programming of Automation and Control Systems (ACS)

Automation and Control Systems typically involve programming and configuration of PLC, DCS, SCADA, and RTU devices, plus the networks and network devices that connect them.

Specialized programming and configuration devices and software are also provided for the control devices themselves, and at least some of the networks that connect them. For example, a PLC vendor may provide programmming tools for their own PLCs and networks (for example Allen Bradley or Siemens PLCs and networks). They may even support some competitor's PLCs and networks. However, they do not typically provide programming for DCS (Distributed Control Systems) devices and networks, such as those from Honeywell or Emerson.

Some standards exist for programming and configuring these devices and networks. The ISA 108 Standard defines requirements for configuring instrumentation and some control devices. ISA 100, the Fieldbus Foundation, and others provide standards for other industrial networks.

Some vendors provide "vendor agnostic" configuration management systems, but products and standards are still quite diverse.  Programming of PLC and DCS systems have therefore been described separately below.

• MLM-035-A: Cyber Secure PLC and RTU Concepts - This Micro-Learning Module discusses principles for the design and operation of PLCs and RTUs. It describes the components of a PLC, the cybersecurity risks, and the vulnerabilities it involves.
• MP4 video of slides with spoken narrative (9 minutes)
• PDF slides with written narrative below each slide (9 pages)
• PPTX slides with written narrative in Notes field (9 slides)


• MLM-035-B: Guidelines for engineers who are creating or modifying PLC software to control plant equipment. These guidelines are practical for all IEC 61311 programming languages, including Ladder Logic, Function Blocks, Structured Text, and Sequential Function Charts.
• MP4 video of slides with spoken narrative (8 minutes)
• PDF slides with written narrative below each slide (11 pages)
• PPTX slides with written narrative in Notes field (11 slides)


• MLM-035-C: Cybersecure Operation of ACS devices and networks including PLC DCS, SCADA and similar industrial products.
• MP4 video of slides with spoken narrative (future)
• PDF slides with written narrative below each slide (future)
• PPTX slides with written narrative in Notes field (future)


• MLM-035-D: Cybersecure Maintenance and Upgrade of ACS devices and networks including PLC DCS, SCADA and similar industrial products.
• MP4 video of slides with spoken narrative (future)
• PDF slides with written narrative below each slide (future)
• PPTX slides with written narrative in Notes field (future)