<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ics-risk-assessment
description: >-
  Conduct structured risk assessments for ICS/SCADA environments using
  IEC 62443, NIST SP 800-82, and consequence-driven methodologies that
  account for safety, environmental, and production impact.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - risk-assessment
  - ics
  - scada
  - iec-62443
  - nist
  - threat-modeling
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0800", "T0826"]
  nist-csf: ["ID.RA-1", "ID.RA-5", "ID.RA-6"]
  iec-62443: ["SR 1.1", "ZCR 1.1"]
  uuid: a1b2c3d4-1001-4000-a001-000000000008
---

# Performing ICS Risk Assessment

## Overview

ICS risk assessment extends beyond confidentiality to prioritize safety, availability,
and physical process integrity. A compromised PLC can cause explosions, environmental
releases, or equipment destruction. Assessment must use consequence-driven analysis,
zone and conduit modeling per IEC 62443, and incorporate process safety perspectives.

Mode: `[MODE: ARCHITECT]` for framework design; `[MODE: BLUE]` for execution.

## Prerequisites

| Requirement | Details |
|---|---|
| ICS network architecture diagrams with Purdue Model levels | Required |
| Process hazard analysis (PHA) results and safety integrity levels (SIL) | Required |
| IEC 62443 zone and conduit diagrams | Required |
| Asset inventory with criticality ratings | Required |
| Threat intelligence specific to ICS sector (CISA ICS-CERT, Dragos) | Required |
| Stakeholder access | OT engineers, process safety, operations, IT security |

## Key Concepts

### IEC 62443 Zone/Conduit Model

```yaml
zones:
  - id: Z1-Safety
    sl_target: SL4
    assets: [SIS controllers, Safety PLCs]
    consequence: {safety: Catastrophic, financial: ">$50M"}
  - id: Z2-Control
    sl_target: SL3
    assets: [Process PLCs, DCS controllers]
conduits:
  - from: Z3-Supervision
    to: Z2-Control
    protocols: [S7comm, EtherNet/IP]
    controls: [Industrial firewall, Protocol inspection, IP allowlist]
```

### Consequence-Driven Risk Scoring

```bash
python3 -c "
import json
C = {'safety':{'catastrophic':5,'critical':4,'major':3},
     'production':{'extended_shutdown':5,'process_upset':4},
     'financial':{'over_50m':5,'5m_50m':4,'1m_5m':3}}
def risk(likelihood, ratings):
    mc = max(C[k].get(v,1) for k,v in ratings.items())
    r = likelihood * mc
    return {'risk':r, 'level':'Critical' if r>=20 else 'High' if r>=12 else 'Medium' if r>=6 else 'Low'}
print(json.dumps(risk(3,{'safety':'catastrophic','production':'extended_shutdown','financial':'over_50m'}),indent=2))"
```

### Security Level Gap Analysis

```bash
python3 -c "
frs = {'FR1_access':{'t':3,'c':2},'FR3_integrity':{'t':3,'c':1},'FR5_flow':{'t':3,'c':3},'FR7_avail':{'t':3,'c':3}}
for fr,d in frs.items():
    print(f'{fr}: SL{d[\"c\"]}/{d[\"t\"]} [{\"GAP\" if d[\"c\"]<d[\"t\"] else \"OK\"}]')"
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 performing_ics_risk_assessment_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 performing_ics_risk_assessment_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 performing_ics_risk_assessment_report.py --results results/ --output report.json
```

## Verification

- [ ] Zones and conduits mapped per IEC 62443
- [ ] Consequence analysis complete
- [ ] Threat scenarios with sector intelligence
- [ ] ICS-weighted risk scoring
- [ ] Security level gap analysis per zone
- [ ] Recommendations prioritized
- [ ] Stakeholder review completed
- [ ] Risk register maintained

## Detection Opportunities

- Findings not remediated in SLA → exposure
- New assets without zone → unmanaged risk
- New ICS malware → reassessment trigger
- Process safety changes → re-evaluation

```yaml
title: Ics Risk Assessment Detection
id: 04ce0f60-c0f4-4afe-9732-c5a08193058f
status: experimental
description: Detects suspicious activity related to performing ics risk assessment techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0800
  - attack.t0826
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- IEC 62443-3-2: Security Risk Assessment
- NIST SP 800-82 Rev 3
- NIST SP 800-30 Rev 1: Risk Assessments
- ISA-TR84.00.09
