If an attacker takes over your control software, the last protection is whatever the physical process will not allow. CISA's water plant advisory recommends independent cyber-physical safety systems, such as limits on chemical pump size, valve gearing and pressure switches, that stop dangerous conditions regardless of software commands.
The idea in one example
In the February 2021 water treatment intrusion, the actor raised sodium hydroxide dosing through the SCADA software. Staff reversed it before an alarm fired. The advisory's longer-term advice is not another password rule. It is to install safety systems that physically prevent dangerous conditions if the control system is compromised.
A mechanical limit does not read a network packet. If a pump cannot physically deliver more than a safe amount, a malicious setpoint becomes a nuisance, not a hazard.
Software controls versus physical limits
| Layer | Example | Fails if |
|---|---|---|
| Software alarm | High dosing alert | Alarm is disabled or delayed |
| Software interlock | Logic that blocks unsafe setpoints | Logic is rewritten |
| Independent safety system | Separate controller | Attacker reaches it, as with HatMan |
| Physical limit | Pump capacity, valve gearing, pressure switch | Hardware is changed on site |
Each layer protects against a different failure. The lower rows depend less on anyone's password.
How to find your existing limits
- List the worst outcomes a setpoint change could cause: overdosing, overpressure, overheating, flooding.
- For each, ask what physically stops it. Do not accept "an alarm" as the whole answer.
- Ask operators and engineers. They often know about limits that never made it into a document.
- Record the answer next to the asset in your inventory.
Where to add limits
Prioritize processes where the worst outcome harms people or the public. Options include sizing equipment so its maximum output is safe, adding independent mechanical or hardwired devices, and keeping safety systems on separate networks. Involve a qualified process safety engineer, since changes to safety design need proper review.
Caveats
Physical limits are not a replacement for cybersecurity. They protect the worst case, not availability or data. Safety controllers themselves can be targeted, as CISA's analysis of HatMan shows, covered in our explainer. That is why the lowest layer, hardware that cannot be reprogrammed, deserves the most credit.
A worked example of the thinking
Imagine a treatment step where a pump adds a chemical. Ask three questions. What is the most the pump can physically deliver per hour? How long would it take to reach a harmful level at that rate? Who or what would notice before then?
If the answers are "far more than needed," "ten minutes" and "an alarm on the same system," you have a gap. Options include a smaller pump, a day tank sized so it cannot hold a harmful quantity, or an independent sensor with its own shutoff. The right answer depends on the process, so work it through with the engineers who own it.
Quick check
Is this the same as a safety instrumented system?
Not exactly. A safety instrumented system is a controller. The advisory's examples also include purely physical limits such as pump size and valve gearing.
Who should decide which limits to add?
A qualified process safety engineer, working with operations and security.
Safeguard focuses on software supply chain security, such as policies and gates in pipelines, and does not design or verify physical safety systems.
Sources
Last reviewed: 19 October 2026.
