MITRE ATT&CK for ICS: the twelve tactics explained for plant teams

MITRE ATT&CK for ICS is a matrix of tactics and techniques describing how adversaries operate against industrial control systems. It lists twelve tactics, from Initial Access to Impact, and adds two with no Enterprise style equivalent in name: Inhibit Response Function and Impair Process Control.

What the matrix covers

The ICS matrix on the MITRE site covers four platforms: Embedded, Windows, Linux and Network Devices. Embedded matters here because many controllers are purpose built devices, not general computers. Technique counts change as MITRE updates the knowledge base, so check the live page before quoting numbers.

The twelve tactics

1. Initial Access. How the adversary first gets in, such as exposed services or remote access.
2. Execution. Running code or commands on a device or workstation.
3. Persistence. Staying in after reboots or credential changes.
4. Privilege Escalation. Gaining higher rights.
5. Evasion. Avoiding detection, including by hiding in normal looking activity.
6. Discovery. Learning what devices and processes exist.
7. Lateral Movement. Moving between systems and zones.
8. Collection. Gathering process data and configuration.
9. Command and Control. Communicating with compromised systems.
10. Inhibit Response Function. Preventing safety, protection or alarm functions from working.
11. Impair Process Control. Manipulating how the physical process is controlled.
12. Impact. The final effect on operations, safety or equipment.

The descriptions above are plain language summaries of the tactic names. Read MITRE's own definitions for exact wording.

Why the last three stand apart

The two ICS specific tactics describe attacks on the process and its protections. Triton, documented in MITRE's software entries, is described as able to reprogram safety logic. That sits under the idea of inhibiting the response function. Impact then records what the plant actually experiences.

Using the matrix without a big tool

• Threat informed reviews. Pick a tactic per month and ask where you could detect it.
• Tabletop scenarios. Walk a scenario through the tactics in order and note where your team would first notice.
• Gap lists. Mark techniques you cannot currently see, such as unauthorised controller programming.
• Common language. Report incidents using the same tactic names your vendors and agencies use.

Limits

ATT&CK describes behaviour. It does not rank risk for your plant, and it does not tell you what to buy. Pair it with your asset inventory and your list of most consequential processes.

A small exercise

Take last year's most likely incident, such as ransomware in IT with a risk to operations. Write it as a chain across the tactics. Next to each step, write the log, alarm or person that would show it. Blank cells show where visibility is thin.

Quick check

Sources

• MITRE ATT&CK, ICS Matrix
• MITRE ATT&CK, Triton (S1009)

Last reviewed: 19 October 2026.