Full ICS
Start here for a whole system, cross-platform attack paths, controller behavior, and process consequences.
Practical interpretation · not a new taxonomy
Classify the component, not the product family.
MITRE ATT&CK® for ICS separates asset function from platform. A DeltaV system contains controllers, workstations, servers, I/O, and networking components—not one universal “Embedded” device.
Three questions before selecting a view
- What does it do? Controller, HMI, engineering workstation, historian, gateway, switch, or firewall.
- How is it implemented? Windows, verified Linux, an RTOS, proprietary firmware, a virtual runtime—or Unknown.
- Which behavior is being analyzed? Host execution, controller logic, firmware, networking configuration, or physical-process consequences.
Role, OS, and exposed surface belong in separate fields. Use the union of relevant views, then tailor it with capabilities, prerequisites, consequences, and evidence.
Which view should I start with?
Embedded
Purpose-built controllers and field devices: logic, firmware, operating modes, tasking, and I/O. The underlying OS may be unknown.
Windows
Windows engineering/operator workstations, OT servers, and actual Windows surfaces. COTS describes sourcing, not an operating system.
Linux
Verified Linux hosts and Linux surfaces in controllers, gateways, or appliances. Keep their controller or appliance role in scope too.
Network Devices
Communications infrastructure and management planes: switches, routers, and suitable firewalls or gateways—not everything with an IP address.
Full ICS is the safest starting reference for a system-wide scenario or uncertain classification. Enterprise ATT&CK complements ICS with additional host, identity, remote-access and network-infrastructure detail. Similar names are not an official one-to-one crosswalk.
Illustrative component breakdown
Where does DeltaV fit?
| Component | Starting scope | What to verify |
|---|---|---|
| Traditional physical DCS controller | Embedded; A0017 DCS Controller | Verify the model and firmware. This is a generic role-based starting point, not an official MITRE mapping to every DeltaV model or a claim that its OS is Linux. |
| ProfessionalPLUS / engineering workstation | Windows for a conventional supported Windows deployment | Its Windows engineering tools may target an Embedded controller. Keep the initiating workstation and target controller separate. |
| DeltaV Live / Operate operator workstation | Windows; HMI/workstation role | Use the actual supported OS, runtime and permissions. An industrial enclosure does not erase the Windows surface. |
| Application / historian server | Actual OS and application role; Windows for the reviewed Windows configuration | Server does not mean Linux. Record each host, VM and application role separately. |
| Traditional hardware SIS controller | Embedded; safety-controller role | Distinguish the safety device from its engineering workstation and from the DCS controller. Confirm the actual SIS architecture. |
| Remote / intelligent I/O | Embedded; Field I/O role where appropriate | Review module-specific firmware, writable configuration and management interfaces; do not assume every module offers the same surfaces. |
| Associated switch, router or firewall | Network Devices starting review; actual appliance/OS surfaces | Classify communications infrastructure separately. Not every DeltaV network node is a Network Device. |
| DeltaV IQ / software-defined control | Inspect supported runtime, guest, host and management layers | Emerson describes server-based control. Do not generalize the physical-controller example or guess the OS of a software-defined controller. |
The reviewed Emerson Workstations and Servers for the DeltaV DCS data sheet (July 2026, pp. 1–3 and 11–18) describes Windows workstation/server options. Page 18 notes that Windows IoT was formerly called Windows Embedded. That historical name does not remove Windows OS behavior from scope. Check compatibility for the installed DeltaV release.
Emerson’s DeltaV v16/IQ description is the basis for the server-based-control qualification. Vendor documents are linked, not redistributed.
COTS does not mean Windows.
Commercial off-the-shelf describes sourcing. A COTS host can run Windows, Linux or another platform. An industrial application on Windows is not automatically an Embedded controller; a software controller on a general-purpose OS still deserves controller-specific analysis.
Linux is not just servers.
Linux may underlie controllers, RTUs, gateways and appliances as well as workstations/servers. But controllers also use RTOSs and proprietary firmware. The reviewed sources do not support “controllers are almost all Linux.” Record an unknown OS as Unknown.
For a confirmed embedded-Linux controller, retain controller/Embedded behavior and add relevant Linux services, accounts, shell and process surfaces. Selecting Linux alone can omit controller-specific behavior.
What counts as Network Devices?
Think communications infrastructure, not “anything with Ethernet.”
- Switches and routers, including managed industrial switches and industrial WAN/cellular routers.
- Firewall/security appliances, distinguished from firewall software on a Windows/Linux server.
- Wireless access points, bridges and industrial radios, according to actual role and interfaces.
- Suitable protocol gateways, serial device servers and communications concentrators; some also fit Data Gateway, RTU, Embedded or OS-specific analysis.
- VPN and remote-access appliances, classified by implementation. An appliance, a VPN server and a Windows jump host do not have identical surfaces.
An unmanaged switch is still a network asset, but techniques requiring management accounts or writable configuration may not fit. A PLC, HMI or historian does not become a Network Device because it has an IP address.
These are practical scope examples, not extra official asset records. In v20.0, MITRE tags the generic VPN Server with Embedded/Linux/Windows—not Network Devices. Preserve that source fact separately from an analyst’s networking-appliance review scope.
Yes, this reaches the controller level.
MITRE models PLCs, PACs, DCS controllers, RTUs, safety controllers, IEDs and Field I/O. Use their direct technique-to-asset relationships alongside platform filters. Logic downloads, controller tasking, operating modes, firmware and I/O are core ICS behaviors—not merely workstation activity.
One action can cross platform boundaries.
A Windows engineering workstation (A0001) sends a program to a physical DCS controller (A0017; Embedded starting view). T0843 Program Download describes the industrial action. T0889 Modify Program may also fit if an actual modification is evidenced; a download alone does not prove that additional behavior.
The initiating tool’s Windows OS does not decide the target controller’s classification. Approved maintenance is not automatically malicious. Preserve both endpoints, authorization, tool/user identity, project differences and timing.
MITRE’s asset catalog · v20.0
Exact source roles and platform tags, not a model-specific inventory. Expand a role for its MITRE definition; the matrix’s Targeted asset role filter shows its direct technique relationships.
A0001 · WorkstationLinux, Windows
Workstations are devices used by human operators or engineers to perform various configuration, programming, maintenance, diagnostic, or operational tasks. Workstations typically utilize standard desktop or laptop hardware and operating systems (e.g., MS Windows), but run dedicated control system applications or diagnostic/management software to support interfacing with the control servers or field devices. Some workstations have a fixed location within the network architecture, while others are transient devices that are directly connected to various field devices to support local management activities.
A0002 · Human-Machine Interface (HMI)Linux, Windows
Human-Machine Interfaces (HMIs) are systems used by an operator to monitor the real-time status of an operational process and to perform necessary control functions, including the adjustment of device parameters. An HMI can take various forms, including a dedicated screen or control panel integrated with a specific device/controller, or a customizable software GUI application running on a standard operating system (e.g., MS Windows) that interfaces with a control/SCADA server. The HMI is critical to ensuring operators have sufficient visibility and control over the operational process.
A0003 · Programmable Logic Controller (PLC)Embedded
A Programmable Logic Controller (PLC) is an embedded programmable control device. PLCs typically utilize a modular architecture with separate modules used to support its processing capabilities, communication mediums, and I/O interfaces. PLCs allow for the deployment of customized programs/logic to control or monitor an operational process. This logic is defined using industry specific programming languages, such as IEC 61131 (Citation: IEC February 2013), which define the set of tasks and program organizational units (POUs) included in the device’s programs. PLCs also typically have distinct operating modes (e.g., Remote, Run, Program, Stop) which are used to determine when the device can be programmed or whether it should execute the custom logic.
A0004 · Remote Terminal Unit (RTU)Embedded, Linux, Windows
A Remote Terminal Unit (RTU) is a device that typically resides between field devices (e.g., PLCs, IEDs) and control/SCADA servers and supports various communication interfacing and data aggregation functions. RTUs are typically responsible for forwarding commands from the control server and the collection of telemetry, events, and alerts from the field devices. An RTU can be implemented as a dedicated embedded device, as software platform that runs on a hardened/ruggedized computer, or using a custom application program on a PLC.
A0005 · Intelligent Electronic Device (IED)Embedded
An Intelligent Electronic Device (IED) is a type of specialized field device that is designed to perform specific operational functions, frequently for protection, monitoring, or control within the electric sector. IEDs are typically used to both acquire telemetry and execute tailored control algorithms/actions based on customizable parameters/settings. An IED is usually implemented as a dedicated embedded device and supports various network automation protocols to communicate with RTUs and Control Servers.
A0006 · Data HistorianEmbedded, Linux, Windows
Data historians, or historian, are systems used to collect and store data, including telemetry, events, alerts, and alarms about the operational process and supporting devices. The historian typically utilizes a database to store this data, and commonly provide tools and interfaces to support the analysis of the data. Data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network. Data historians often work in a hierarchical paradigm where lower/site level historians collect and store data which is then aggregated into a site/plant level historian. Therefore, data historians often have remote services that can be accessed externally from the ICS network. Many data historian vendors have designed their software to securely transfer data between the ICS and business networks instead of requiring business systems to access the data historian in the ICS network directly.
A0007 · Control ServerEmbedded, Linux, Windows
Control servers are typically a software platform that runs on a modern server operating system (e.g., MS Windows Server). The server typically uses one or more automation protocols (e.g., Modbus, DNP3) to communicate with the various low-level control devices such as Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs). The control server also usually provides an interface/network service to connect with an HMI.
A0008 · Application ServerLinux, Windows
Application servers are used across many different sectors to host various diverse software applications necessary to supporting the ICS. Example functions can include data analytics and reporting, alarm management, and the management/coordination of different control servers. The application server typically runs on a modern server operating system (e.g., MS Windows Server).
A0009 · Data GatewayWindows, Linux, Embedded, Network Devices
Data Gateway is a device that supports the communication and exchange of data between different systems, networks, or protocols within the ICS. Different types of data gateways are used to perform various functions, including: * Protocol Translation: Enable communication to devices that support different or incompatible protocols by translating information from one protocol to another. * Media Converter: Convert data across different Layer 1 and 2 network protocols / mediums, for example, converting from Serial to Ethernet. * Data Aggregation: Collect and combine data from different devices into one consistent format and protocol interface. * Data Mirroring: Create a real-time, exact copy of data streams from devices to a separate destination for redundancy, monitoring, or backup purposes. Data gateways are often critical to the forwarding/transmission of critical control or monitoring data within the ICS. Further, these devices often have remote various network services that are used to communicate across different zones or networks. These assets may focus on a single function listed below or combinations of these functions to best fit the industry use-case.
A0010 · Safety ControllerEmbedded
Safety controllers are typically a type of field device used to perform the safety critical function. Safety controllers often support the deployment of custom programs/logic, similar to a PLC, but can also be tailored for sector specific functions/applications. The safety controllers typically utilize redundant hardware and processors to ensure they operate reliably if a component fails.
A0011 · Virtual Private Network (VPN) ServerEmbedded, Linux, Windows
A VPN server is a device that is used to establish a secure network tunnel between itself and other remote VPN devices, including field VPNs. VPN servers can be used to establish a secure connection with a single remote device, or to securely bridge all traffic between two separate networks together by encapsulating all data between those networks. VPN servers typically support remote network services that are used by field VPNs to initiate the establishment of the secure VPN tunnel between the field device and server.
A0012 · Jump HostEmbedded, Linux, Windows
Jump hosts are devices used to support remote management sessions into ICS networks or devices. The system is used to access the ICS environment securely from external networks, such as the corporate network. The user must first remote into the jump host before they can access ICS devices. The jump host may be a customized Windows server using common remote access protocols (e.g., RDP) or a dedicated access management device. The jump host typically performs various security functions to ensure the authenticity of remote sessions, including authentication, enforcing access controls/permissions, and auditing all access attempts.
A0013 · Field I/OEmbedded
Field I/O are devices that communicate with a controller or data aggregator to either send input data or receive output data. Input data may include readings about a given environment/device state from sensors, while output data may include data sent back to actuators for them to either undertake actions or change parameter values.(Citation: Guidance - NIST SP800-82) These devices are frequently embedded devices running on lightweight embedded operating systems or RTOSes.
A0014 · RoutersEmbedded, Network Devices
A computer that is a gateway between two networks at OSI layer 3 and that relays and directs data packets through that inter-network. The most common form of router operates on IP packets.(Citation: IETF RFC4949 2007)
A0015 · SwitchEmbedded, Network Devices
A switch is a network device that connects endpoints (e.g., workstations, servers, HMIs, PLCs, etc.) so that they can communicate and share data and resources. Switches may operate at either Layer 2 or Layer 3 of the OSI Model and intelligently forward packets across the network based on the specified address (Media Access Control (MAC) address for Layer 2 and Internet Protocol (IP) address for Layer 3). Switches are typically used to define network segments and connect the devices within a particular level of the Purdue Model.
A0016 · FirewallEmbedded, Windows, Linux, Network Devices
A gateway that limits access between networks in accordance with local security policy. In ICS networks, firewalls can exist in multiple locations in the network architecture and serve a variety of purposes. The first, and often the most important, is the firewall segmenting the ICS network from the business network. This firewall acts as the primary network boundary point that controls the ingress/egress of network traffic between the ICS and business networks. This firewall may also be a single device connected to multiple network segments, where the firewall defines individual zones for the different network segments and can control access to the zones and between the zones. This can limit the ability of an adversary to traverse a network.
A0017 · Distributed Control System (DCS) ControllerEmbedded
A Distributed Control System (DCS) Controller is a microprocessor unit that is used to manage automation processes. DCS Controllers are often found in plants (chemical, manufacturing, oil and gas, etc.) where large scale continuous automation processes are required. A DCS Controller typically operates as part of a larger networked system with other DCS Controllers where each DCS Controller manages an individual part of a continuous process. In addition to these other controllers, DCS Controllers operate along side multiple other system components including system software, operator stations, and other embedded field controllers. The distributed nature of DCS Controllers provides scalability, redundancy, and improved process reliability. DCS Controllers are programmed using traditional process automation programming languages (IEC-61131).
A0018 · Programmable Automation Controller (PAC)Embedded
A Programmable Automation Controller (PAC) is an embedded programmable control device. PACs are designed to enable automation applications across integrated software applications, peer controllers (e.g., PLC), Human Machine Interfaces, and other systems. PACs often include advanced features for process control, motion control, drive control, and vision applications. PACs are programmed using traditional process automation programming languages (IEC-61131) and sometimes languages such as C and C++ to support more advanced controls.
No local applicability, prevention or detection coverage is established. Counts, colors and ATT&CK labels are not risk scores, compliance results, or permission to test a live control system.