Which zone does this alert belong to, and why

A setpoint was written by something that is not the HMI

• Z-OPS Lateral Movement — A Level 3 host opens a control-protocol session straight onto Level 1. Lateral Movement is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-CONTROL Impair Process Control — Write Single Register on 40021, twice inside thirty seconds. Impair Process Control acts on the process itself, so it is recorded against the innermost zone this scenario reaches.
• Z-CONTROL Impact — Fill weight follows the written setpoint and product leaves specification. Impact acts on the process itself, so it is recorded against the innermost zone this scenario reaches.

A machine is bridging the office network and the plant network

• Z-ENTERPRISE Initial Access — One host holds a corporate session and a plant session in the same minute. Initial Access is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-ENTERPRISE Discovery — Read Device Identification against PLC-201 — discovery, not control. Discovery is movement toward the process, so it is recorded against the outermost zone this scenario touches.

A safety interlock is being held in an overridden state

• Z-SAFETY Execution — SIS-301 reports its key switch in PROGRAM rather than RUN. Execution acts on the process itself, so it is recorded against the innermost zone this scenario reaches.
• Z-SAFETY Inhibit Response Function — A force on interlock IL-7 is kept alive every half hour and the trip is suppressed. Inhibit Response Function acts on the process itself, so it is recorded against the innermost zone this scenario reaches.
• Z-SAFETY Impact — Vessel pressure climbs past the trip point and nothing trips. Impact acts on the process itself, so it is recorded against the innermost zone this scenario reaches.

Controller firmware is being written while the line is running

• Z-CONTROL Execution — PLC-204 changes mode from RUN to PROGRAM during production. Execution acts on the process itself, so it is recorded against the innermost zone this scenario reaches.
• Z-OPS Lateral Movement — A block transfer runs from the jump host, not the licensed workstation. Lateral Movement is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-CONTROL Persistence — 218 blocks in flight while the HMI loses the capper entirely. Persistence acts on the process itself, so it is recorded against the innermost zone this scenario reaches.

A second master is issuing commands on the control network

• Z-CONTROL Initial Access — An address with no entry in the asset register speaks control protocol. Initial Access is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-CONTROL Impair Process Control — Coil writes that are perfectly well-formed and completely unauthorized. Impair Process Control acts on the process itself, so it is recorded against the innermost zone this scenario reaches.
• Z-CONTROL Impact — The line responds to whichever master wrote last. Impact acts on the process itself, so it is recorded against the innermost zone this scenario reaches.

Batch records are leaving the plant overnight

• Z-DMZ Collection — Bulk reads against the historian's own archive, out of hours. Collection is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-DMZ Discovery — The historian's own interface is in promiscuous mode with no capture job to explain it. Discovery is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-OPS Impact — Volume and destination the historian has never used before. Impact acts on the process itself, so it is recorded against the innermost zone this scenario reaches.

Somebody is driving the operator's panel from elsewhere

• Z-DMZ Initial Access — A contractor account signs in to the jump host from outside, out of hours. Initial Access is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-DMZ Lateral Movement — A second interactive session on the panel while the operator is signed in. Lateral Movement is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-CONTROL Impact — Conveyor coil written off and back on from the panel nobody touched. Impact acts on the process itself, so it is recorded against the innermost zone this scenario reaches.

Legacy pumps are being answered by something that is not the gateway

• Z-CONTROL Collection — A duplicate address claim on the field VLAN, then answers from the wrong host. Collection is movement toward the process, so it is recorded against the outermost zone this scenario touches.
• Z-CONTROL Impair Process Control — Pump 3 reports 48 psi on the screen and 22 psi at the instrument. Impair Process Control acts on the process itself, so it is recorded against the innermost zone this scenario reaches.
• Z-CONTROL Impact — The historian trend stays inside band while the pump has actually stopped. Impact acts on the process itself, so it is recorded against the innermost zone this scenario reaches.