<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ics-change-management
description: >-
  Implement and enforce change management processes for ICS/SCADA covering
  PLC logic changes, network modifications, firmware updates, and configuration
  changes with approval workflows, rollback procedures, and audit trails.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - change-management
  - ics
  - scada
  - configuration-control
  - audit-trail
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0831", "T0845", "T0873"]
  nist-csf: ["PR.IP-3", "PR.IP-12"]
  iec-62443: ["SR 7.6", "SR 2.8"]
  uuid: a1b2c3d4-1001-4000-a001-000000000012
---

# Implementing ICS Change Management

## Overview

Change management in ICS is critical for process safety and security. Uncontrolled
changes to PLC logic, network configurations, or firmware can cause safety incidents,
production outages, or security vulnerabilities. A structured change process ensures
all modifications are authorized, tested, documented, and reversible.

Mode: `[MODE: ARCHITECT]` for process design; `[MODE: BLUE]` for enforcement.

## Prerequisites

| Requirement | Details |
|---|---|
| ICS asset inventory with configuration baselines | Required |
| Change Advisory Board (CAB) with OT, IT, and safety representation | Required |
| Ticketing system integrated with OT operations (ServiceNow, Jira) | Required |
| Configuration management database (CMDB) for OT assets | Required |
| PLC program version control system | Required |
| Rollback procedures for all change types | Required |

## Key Concepts

### Change Classification

```yaml
change_types:
  emergency: {approval: "OT mgr + safety verbal", timeline: Immediate}
  standard: {approval: "Pre-authorized by CAB", timeline: Next window}
  normal: {approval: "Full CAB review", timeline: Scheduled maintenance}
```

### PLC Version Control

```bash
cd /opt/plc-repo && git init
python3 export_plc.py --target 10.10.0.50 --output plc_programs/s7_1500/
git add plc_programs/ && git commit -m "CHG-2026-0042: Updated reactor logic

Approved: J. Smith (OT), M. Jones (Safety)
Rollback: git checkout HEAD~1 -- plc_programs/"
```

### Configuration Drift Detection

```bash
sha256sum /opt/plc-repo/**/*.bin > /secure/checksums.sha256
echo "0 * * * * sha256sum -c /secure/checksums.sha256 | grep FAILED >> /var/log/drift.log" | crontab -

for dev in $(cat ot_devices.txt); do
  cur=$(ssh admin@$dev 'show run' | sha256sum | cut -d' ' -f1)
  base=$(grep "$dev" baselines.txt | cut -d' ' -f1)
  [ "$cur" != "$base" ] && echo "DRIFT: $dev"
done
```

### Change Audit

```bash
python3 -c "
import json
changes = json.load(open('change_log.json'))
unauth = [c for c in changes if not c.get('approved')]
print(f'Total: {len(changes)} | Unauthorized: {len(unauth)}')
for c in unauth: print(f'  {c[\"id\"]}: {c[\"asset\"]} by {c[\"user\"]}')"
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 implementing_ics_change_management_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 implementing_ics_change_management_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 implementing_ics_change_management_report.py --results results/ --output report.json
```

## Verification

- [ ] Change classification defined
- [ ] CAB established
- [ ] Approval workflows documented
- [ ] PLC programs under version control
- [ ] Configuration baselines established
- [ ] Drift detection active
- [ ] Rollback procedures tested
- [ ] Audit trail reviewed monthly

## Detection Opportunities

- Changes without ticket → unauthorized
- Commits without approval → violation
- Config drift → unmanaged change
- Emergency without post-doc → audit gap
- Changes outside windows → violation

```yaml
title: Ics Change Management Detection
id: bc329743-24b1-4809-b1cc-f9715816cd4e
status: experimental
description: Detects suspicious activity related to implementing ics change management techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0831
  - attack.t0845
  - attack.t0873
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- IEC 62443-2-1: Change Management
- NIST SP 800-82 Rev 3
- ITIL Change Management (OT)
- NERC CIP-010: Configuration Change
