A cyber-physical system is a system where computing and physical processes are tied together, so its behavior depends on both the software and the physical parts. Examples include industrial plants, medical devices, vehicles and building controls. Security differs because a failure can hurt people or equipment, not only expose data.
How do standards define them?
NIST's glossary gives two related definitions. One, from SP 800-171 Rev. 3, calls them interacting digital, analog, physical and human components engineered for function through integrated physics and logic. The other, from SP 800-160 Vol. 1 Rev. 1 and attributed to ISO/IEC/IEEE 21840, describes a system integrating computation with physical processes whose behavior is defined by both the computational and the physical parts.
The NIST Framework for Cyber-Physical Systems adds that CPS and related systems, including the Internet of Things and the industrial internet, apply across energy, advanced manufacturing, building control, transportation and health care. The word "human" in the first definition matters: operators and their procedures are part of the system.
NIST's guide to operational technology security, SP 800-82 Rev. 3, covers a closely related area. It describes OT as programmable systems and devices that interact with the physical environment or manage devices that do, and lists industrial control systems, building automation, transportation systems, physical access control and environmental monitoring systems as examples. NIST's page notes an initial public draft of Revision 4 is open for comment until 30 November 2026.
Why does security work differently?
Three things change.
Availability and safety outrank confidentiality. A hospital pump or a chemical process that stops unexpectedly is a hazard. Scanning, patching and rebooting, routine in IT, can themselves cause harm if done without planning. SP 800-82 frames its guidance around the unique performance, reliability and safety requirements of OT.
Lifetimes are long. Equipment is designed to run for years or decades, often on software that cannot be updated easily. Compensating controls such as network separation carry more of the load than patching.
The attack has physical effects. MITRE's ATT&CK matrix for ICS reflects this in its tactic names. Beyond the usual Initial Access, Execution and Persistence, it includes Inhibit Response Function and Impair Process Control, which describe interference with safety systems and with the process itself.
What do attackers use to get in?
The ICS matrix lists many of the same entry points as IT: exploiting public facing applications, external remote services, internet accessible devices, drive by compromise, spearphishing attachments, supply chain compromise and removable media. It also lists insecure credentials, including default and hardcoded ones, and firmware modification as techniques. So the routes are familiar. The consequences are not.
A constructed example
A water utility wants remote access to a pumping station for a vendor. The IT instinct is to open a remote desktop port and share a login. The CPS approach starts from the process: what could a wrong command do, and who must be able to send it? The utility puts the vendor on a jump host in a separate zone, requires individual accounts and approval for each session, records the session, and keeps the safety controller on a network the jump host cannot reach. Patching the station's controller is scheduled for a planned outage with a rollback plan.
How to check or apply this
- Inventory the physical processes and the digital assets that control them, and rank them by consequence of failure, not only by data value.
- Separate networks by function. Put control systems in zones with defined, minimal paths from corporate IT.
- Control remote access with individual accounts, approval and logging. Remove default and hardcoded credentials.
- Plan patching around operations. Test changes in a copy where possible, and schedule them with the people who run the process.
- Monitor passively where active scanning could disturb equipment, and baseline normal commands and traffic.
- Rehearse incident response with operators and engineers present, and include manual operation procedures.
- Ask suppliers for their update process and support period, using the IoT baseline from NIST IR 8259A as a model.
Quick check
Is a cyber-physical system the same as IoT?
They overlap. IoT usually means networked devices. Cyber-physical systems stress the tie between computation and physical processes, and include industrial and safety systems that may not be internet connected.
Can I run a normal vulnerability scan on control equipment?
Not without checking first. Some equipment fails or behaves badly under active scans. Use passive monitoring or coordinate scans with operators during planned windows.
Sources
- NIST Glossary, cyber-physical systems
- NIST, Framework for Cyber-Physical Systems, Volume 1: Overview
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- MITRE ATT&CK for ICS
Last reviewed: 18 October 2026.
