Back up PLC logic and check it against a known good baseline

Keep an off device backup of every controller's logic and configuration, record a hash of each, and compare the running program with that baseline on a schedule. Several CISA advisories recommend exactly this, because attackers who reach a PLC may erase or change its logic.

Why it matters

In the Unitronics campaign described by CISA, actors erased the original ladder logic and replaced it with logic that had no inputs or outputs. Operators lost visibility and remote control. A current backup is what turns that from a long outage into a restore. The advisory asks owners to create and test backups of PLC logic and configurations.

AA22-103A recommends offline backups and verifying firmware and configuration files with hashing and integrity checks. The Volt Typhoon advisory recommends monitoring for unauthorised controller change attempts and checking controller logic against a known good baseline. The Siemens S7 alert asks owners to verify firmware against gold copy backups and to monitor for ladder logic changes.

Build the baseline

1. Inventory first. Each controller needs an identity, owner and location in the inventory.
2. Export logic and configuration using the vendor's engineering software, in the vendor's supported format.
3. Record firmware version and any hardware configuration.
4. Compute a hash of each exported file and store the hash separately from the file.
5. Store copies offline, with at least one outside the OT network, and restrict who can write to them.
6. Label a gold copy as the approved version, with date, approver and change ticket.

Keep it current

A baseline that is two years stale will flag every legitimate change. Tie updates to change management: when an approved change finishes, export, hash, store and update the gold copy as part of the closing steps.

Compare on a schedule

• Pull the running program from the controller, using a read only method where the platform allows.
• Hash it and compare it with the gold copy.
• Investigate any difference that has no matching change ticket.
• Also check that the controller is in the expected mode. The Volt Typhoon advisory advises avoiding leaving controllers in remote program mode during operation where possible.

Whether you can do this without disturbing the process depends on the platform and your vendor's guidance, so trial it on a spare unit first.

Test the restore

A backup that has never been restored is a hope. At least once, restore a gold copy to a spare or staging controller and confirm it runs. Record how long it took, and who needed to be involved.

Protect the backups

Backups contain process logic and sometimes credentials. Keep them access controlled and encrypted where your tools allow, and log who retrieves them.

Quick check

Sources

• CISA, IRGC-Affiliated Cyber Actors Exploit PLCs, AA23-335A
• CISA, APT Cyber Tools Targeting ICS/SCADA Devices, AA22-103A
• CISA, Volt Typhoon advisory AA24-038A
• CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A

Last reviewed: 19 October 2026.