What stands behind each requirement, line by line

Zones Z-CONTROL, Z-OPS · FR1, FR3, FR6

1. Lateral Movement · T0886 Remote Services

   In the incident: FrostyGoop reached the heating controllers over plain Modbus from a host already inside the network.

   On the line: A Level 3 host opens a control-protocol session straight onto Level 1.

   Source: FrostyGoop heating outage, 2024

2. Impair Process Control · T0836 Modify Parameter

   In the incident: Registers were written directly, changing the values the controllers ran to.

   On the line: Write Single Register on 40021, twice inside thirty seconds.

   Source: FrostyGoop heating outage, 2024

3. Impact · T0831 Manipulation of Control

   In the incident: At Maroochy the process moved because commands arrived from a master nobody had authorized.

   On the line: Fill weight follows the written setpoint and product leaves specification.

   Source: Maroochy Shire sewage spills, 2000

FR7 is why the controller stays on the network: the batch is running, and cutting the PLC removes the control room's view without stopping the fill.

Zones Z-CONTROL, Z-ENTERPRISE · FR1, FR5

1. Initial Access · T0822 External Remote Services

   In the incident: TRITON's operators reached the safety network from an engineering workstation that was also reachable from the business side.

   On the line: One host holds a corporate session and a plant session in the same minute.

   Source: TRITON / TRISIS, 2017

2. Discovery · T0846 Remote System Discovery

   In the incident: INCONTROLLER enumerated controllers over their own protocols before touching anything.

   On the line: Read Device Identification against PLC-201 — discovery, not control.

   Source: PIPEDREAM / INCONTROLLER, 2022

The conduit is cut at the switch port, not by blocking the process protocols the line runs on.

Zones Z-SAFETY, Z-CONTROL · FR2, FR3, FR7

1. Execution · T0858 Change Operating Mode

   In the incident: TRITON required the safety controller's key switch to be left in PROGRAM to write to it at all.

   On the line: SIS-301 reports its key switch in PROGRAM rather than RUN.

   Source: TRITON / TRISIS, 2017

2. Inhibit Response Function · T0878 Alarm Suppression

   In the incident: The safety function itself was the target — removing the plant's protection without stopping production.

   On the line: A force on interlock IL-7 is kept alive every half hour and the trip is suppressed.

   Source: TRITON / TRISIS, 2017

3. Impact · T0880 Loss of Safety

   In the incident: Had it succeeded, the process would have run with no functioning safety trip.

   On the line: Vessel pressure climbs past the trip point and nothing trips.

   Source: TRITON / TRISIS, 2017

Isolating the safety controller is the FR7 failure: the force lives in the device, so the network cut removes the view and leaves the hazard.

Zones Z-CONTROL, Z-OPS · FR2, FR3, FR7

1. Execution · T0858 Change Operating Mode

   In the incident: Controllers must be put into PROGRAM before logic or firmware can be written to them.

   On the line: PLC-204 changes mode from RUN to PROGRAM during production.

   Source: PIPEDREAM / INCONTROLLER, 2022

2. Lateral Movement · T0843 Program Download

   In the incident: Stuxnet downloaded its own blocks into controllers from the engineering toolchain.

   On the line: A block transfer runs from the jump host, not the licensed workstation.

   Source: Stuxnet, 2010

3. Persistence · T0857 System Firmware

   In the incident: Firmware-level changes survive a restart and are not visible from the operator screens.

   On the line: 218 blocks in flight while the HMI loses the capper entirely.

   Source: Stuxnet, 2010

FR7 outranks containment: cutting a transfer at block 118 of 218 can leave the controller unbootable, which is worse than the change itself.

Zones Z-CONTROL · FR1, FR2, FR5, FR7

1. Initial Access · T0848 Rogue Master

   In the incident: At Maroochy the adversary simply was a master — legitimate equipment, no authorization.

   On the line: An address with no entry in the asset register speaks control protocol.

   Source: Maroochy Shire sewage spills, 2000

2. Impair Process Control · T0855 Unauthorized Command Message

   In the incident: Industroyer sent protocol-valid command messages; nothing about the frames was malformed.

   On the line: Coil writes that are perfectly well-formed and completely unauthorized.

   Source: Industroyer / CRASHOVERRIDE, 2016, repeated as Industroyer2 in 2022

3. Impact · T0831 Manipulation of Control

   In the incident: FrostyGoop moved a real process with nothing more than Modbus writes.

   On the line: The line responds to whichever master wrote last.

   Source: FrostyGoop heating outage, 2024

Blocking Modbus outright satisfies FR5 and breaks FR7 — it takes the control room's hands off a running line.

Zones Z-OPS, Z-DMZ · FR4, FR5, FR6

1. Collection · T0811 Data from Information Repositories

   In the incident: Dragonfly's objective was the operational record: diagrams, engineering files and historian data.

   On the line: Bulk reads against the historian's own archive, out of hours.

   Source: Dragonfly / Energetic Bear energy-sector intrusions, 2014–2018

2. Discovery · T0842 Network Sniffing

   In the incident: Dragonfly watched OT traffic from a foothold to learn the protocols and asset names before taking anything.

   On the line: The historian's own interface is in promiscuous mode with no capture job to explain it.

   Source: Dragonfly / Energetic Bear energy-sector intrusions, 2014–2018

3. Impact · T0882 Theft of Operational Information

   In the incident: Data left through the business boundary over long periods without disturbing the process.

   On the line: Volume and destination the historian has never used before.

   Source: Dragonfly / Energetic Bear energy-sector intrusions, 2014–2018

Nothing in the process moved. Taking the historian offline destroys the evidence and the production record over a problem a boundary block already stops.

Zones Z-CONTROL, Z-DMZ · FR1, FR2, FR6

1. Initial Access · T0822 External Remote Services

   In the incident: Sandworm entered through legitimate remote access and used it as the operators would.

   On the line: A contractor account signs in to the jump host from outside, out of hours.

   Source: Ukraine electric power attack, 2015

2. Lateral Movement · T0859 Valid Accounts

   In the incident: Valid accounts, not exploits — the sessions looked exactly like sanctioned work.

   On the line: A second interactive session on the panel while the operator is signed in.

   Source: Ukraine electric power attack, 2015

3. Impact · T0831 Manipulation of Control

   In the incident: Breakers were opened from the operators' own HMIs while they watched.

   On the line: Conveyor coil written off and back on from the panel nobody touched.

   Source: Unitronics PLC and HMI intrusions, 2023

The session ends at the jump host. Killing the panel's network takes the running line away from the operator standing in front of it.

Zones Z-CONTROL · FR3, FR6, FR7

1. Collection · T0830 Adversary-in-the-Middle

   In the incident: Sitting between the controller and the field device is how the replies get to be chosen.

   On the line: A duplicate address claim on the field VLAN, then answers from the wrong host.

   Source: Maroochy Shire sewage spills, 2000

2. Impair Process Control · T0856 Spoof Reporting Message

   In the incident: Maroochy's system was fed false state; FrostyGoop made controllers report wrong measurements.

   On the line: Pump 3 reports 48 psi on the screen and 22 psi at the instrument.

   Source: FrostyGoop heating outage, 2024

3. Impact · T0832 Manipulation of View

   In the incident: Stuxnet replayed recorded normal values so the operators saw a healthy process.

   On the line: The historian trend stays inside band while the pump has actually stopped.

   Source: Stuxnet, 2010

When the screen and the physical instrument disagree, the screen is the thing to doubt — which is the whole reason FR3 exists.