Chemical Sector Cybersecurity: Securing Process Safety in CFATS-Era Plants

01Key takeaways

1. 01

   Chemical cybersecurity is about protecting physical process safety, not only data: the worst outcomes are releases, fires and runaway reactions, not breaches.

2. 02

   The basic process control system (BPCS or DCS) and the safety instrumented system (SIS) are different layers and must stay independent; a single network compromise should never reach both.

3. 03

   Layer of protection analysis (LOPA) logic applies to cyber risk too: independent protection layers only count if an attacker cannot defeat several of them through one path.

4. 04

   CFATS lapsed in July 2023 and has not been reauthorized as of 2026, so chemical facilities should anchor controls in IEC 62443, NIST SP 800-82 and CISA guidance rather than wait for the program to return.

5. 05

   Reducing bidirectional reachability between the process network and IT, and isolating the SIS, removes the routes attackers need to influence safety functions.

02What chemical plant cybersecurity actually protects

Chemical plant cybersecurity protects the control and safety systems that hold a process inside its design envelope. In most plants that means a distributed control system (DCS) running continuous or batch operations, a basic process control system (BPCS) for regulatory control, and a separate safety instrumented system (SIS) that exists to bring the process to a safe state when something goes wrong. The cyber goal is to keep these systems doing exactly what their designers intended, and nothing else.

The defining feature of the sector is consequence. In manufacturing, a compromised line usually means scrap, downtime and lost output. In a chemical plant handling reactive, toxic or flammable material, a manipulated setpoint or a disabled interlock can move the process toward a runaway reaction or a loss of containment. That is why chemical cybersecurity is treated as an extension of process safety rather than an IT problem with a plant attached.

The blunt framing for chemical sites: the asset you are defending is not the server, it is the safe operating envelope of the process. Cyber controls succeed when they keep temperature, pressure, level and flow inside their limits.

03Why the threat is different in reactive-chemistry plants

Reactive chemistry has very little tolerance for the wrong conditions. Exothermic reactions can self-accelerate once temperature rises past a threshold, and the time available to intervene can be measured in minutes. A cyber actor does not need to destroy equipment to cause harm; subtly falsifying a sensor reading, freezing an alarm, or delaying a controller response can be enough to push a reactor past the point where operators can recover it manually.

The threat landscape is real and documented. The 2017 TRITON/TRISIS intrusion specifically targeted a Schneider Electric Triconex safety instrumented system at a petrochemical facility, attempting to reprogram safety controllers. It was the first known malware built to manipulate an SIS directly, and it reframed the industry's risk model: attackers are willing to go after the last line of defense, not just the control layer. MITRE ATT&CK for ICS now catalogs techniques such as Modify Controller Tasking, Spoof Reporting Message and Inhibit Response Function that map directly to these scenarios.

• Falsified process variables that hide a developing upset from operators and automated logic.
• Manipulation or disabling of interlocks and trip setpoints in the safety system.
• Loss of view or loss of control, leaving operators blind during a critical excursion.
• Manipulation of batch recipes or sequencing in batch and semi-batch reactive processes.
• Ransomware on engineering and historian systems that forces an unplanned, and potentially unsafe, shutdown.

04BPCS, DCS and SIS: keep the layers independent

The single most important architectural principle in a chemical plant is independence between the control layer and the safety layer. The BPCS or DCS runs the process day to day. The SIS does nothing until a defined hazardous condition appears, then it acts to reach a safe state. IEC 61511, the process-sector safety standard, expects the SIS to be functionally separate from the control system so that a single fault cannot both cause a demand and defeat the protection against it. That separation principle is just as valid for cyber faults as for hardware faults.

In cyber terms this means the SIS should not share a flat network with the BPCS, should not be administered through the same engineering workstation by default, and should not be reachable from IT or remote-access paths. Where data must flow from the safety system for monitoring or compliance, it should flow outward only. A safety controller that can be reprogrammed from a routable corporate path has effectively merged the control and safety layers into one attack surface, which is exactly what IEC 61511 separation is meant to prevent.

BPCS / DCS

The basic process control system or distributed control system that runs normal operations: regulatory control, sequencing, alarms and operator interface.

SIS

The safety instrumented system: independent sensors, logic solver and final elements that trip the process to a safe state on a defined demand, rated to a Safety Integrity Level (SIL).

Independence

The design property that no single fault, error or attack can both create a hazardous demand and disable the layer meant to protect against it.

05Mapping cyber risk onto layers of protection

Chemical engineers already think in independent protection layers. Layer of protection analysis (LOPA) evaluates how many independent safeguards stand between an initiating event and a serious consequence: process design, the BPCS, alarms with operator response, the SIS, relief devices, and physical mitigation. Each layer only counts if it is genuinely independent of the others and of the initiating cause.

Cybersecurity fits this model cleanly, and it also exposes a trap. A common-cause cyber compromise can defeat several layers at once if they share infrastructure. If the BPCS, the alarm system and the SIS engineering tools all live on the same network and trust the same credentials, an attacker who reaches that network has not bypassed one independent protection layer, they have bypassed several. The cyber task is to make sure that the independence assumed in the LOPA is also true on the network, not just on the P&ID.

A protection layer that an attacker can disable from the same foothold as the layer above it is not independent. Cyber common-cause failure is the quiet way a multi-layer safety case collapses to a single layer.

06Practical controls that fit chemical operations

The controls that work in chemical plants are the ones that respect process safety constraints: long asset lifecycles, scarce shutdown windows, and a strong bias against anything that could trip a running unit. The starting point is knowing what you have and how it connects, then progressively removing unnecessary reachability without disturbing the running process.

• Build and maintain an OT asset inventory that includes controllers, safety logic solvers, engineering workstations and their firmware versions.
• Segment the plant into IEC 62443 zones and conduits, with the SIS in its own zone and the most restrictive conduit rules.
• Lock down engineering workstations and the safety-system programming environment, including physical key switches on safety controllers where available.
• Control and log all remote access for vendors and integrators through brokered, time-limited, monitored sessions rather than standing connections.
• Forward historian data, alarms and security telemetry outward for monitoring without opening an inbound path to the process network.
• Define safe, tested shutdown and recovery procedures for cyber scenarios so a response never forces an unsafe state.

None of these controls is exotic, and that is the point. Chemical plants rarely fail because a defender lacked a clever tool; they are exposed because a process network grew connections over years that no one mapped, and an interactive path to safety-related systems quietly became normal.

07Standards and compliance in the post-CFATS landscape

For roughly fifteen years the Chemical Facility Anti-Terrorism Standards (CFATS), administered by CISA, set baseline security expectations for high-risk chemical facilities, including a cybersecurity performance standard. The statutory authority for CFATS lapsed on 28 July 2023 when Congress did not reauthorize it, and as of 2026 the program remains expired: CISA cannot enforce CFATS requirements or conduct its inspections. Facilities should not read that lapse as a reduction in real risk.

With CFATS dormant, the practical compliance anchor is the broader standards stack. ISA/IEC 62443 provides the zones-and-conduits model and security levels for industrial automation. IEC 61511 governs functional safety for the process sector and underpins SIS independence. NIST SP 800-82 Rev. 3 gives OT-specific guidance, and CISA's cross-sector performance goals and ICS advisories remain active. Many operators also align with EPA Risk Management Program and OSHA Process Safety Management obligations, which increasingly intersect with cyber-induced process hazards.

ISA/IEC 62443

The series for industrial automation and control system security: defines zones, conduits, security levels and a risk-based approach.

IEC 61511

Functional safety standard for the process industries; establishes the lifecycle and independence expectations for the SIS.

NIST SP 800-82 Rev. 3

Guide to Operational Technology (OT) Security; practical control selection tailored to ICS constraints.

CFATS (lapsed)

The federal chemical-security program that expired in July 2023; useful as historical baseline, not as a current legal requirement in 2026.

08Common pitfalls that undermine chemical OT security

Most chemical-sector incidents trace back to a handful of recurring design and operating mistakes rather than novel attacks. They tend to accumulate slowly, during expansions, vendor projects and turnarounds, until the original segmentation no longer reflects reality.

• Treating the SIS as just another node on the control network instead of an isolated safety zone.
• Shared engineering workstations that can program both the BPCS and the safety logic solver.
• Standing vendor VPNs and remote-desktop paths that reach deep into the process network.
• Flat historian and reporting links that provide an inbound route from IT back into operations.
• Assuming LOPA independence on paper while the layers share networks, credentials and time sources.
• Patching and security testing planned only around rare turnarounds, leaving long windows of known exposure.

The unifying theme is unmanaged bidirectional reachability. Every one of these pitfalls is, at root, a path that lets traffic move toward safety-critical systems when the process only ever needed data to move the other way.

09Where one-way transfer and exposure reduction fit

A large share of the data a chemical plant must share is inherently one-directional. Historian values, batch records, emissions and environmental data, alarm logs and security telemetry all need to leave the process environment for reporting, analytics and the SOC. None of those flows requires the receiving side to send anything back into the plant. That is exactly the condition where one-way data transfer is a strong structural fit.

A data diode or unidirectional gateway enforces that one-way property in hardware, so the corporate, cloud or monitoring side has no network path back toward the DCS or, critically, the SIS. For high-consequence boundaries, some operators go further and keep certain links disconnected by default, connecting only under defined, supervised conditions. The aim is to make the dangerous direction physically unavailable rather than merely filtered by a rule that can drift or be misconfigured.

A one-way boundary is one control among many, not a substitute for the rest. It pairs naturally with IEC 62443 segmentation, hardened engineering workstations and disciplined remote-access management. Teams comparing approaches can evaluate a controlled-connectivity and one-way transfer design alongside firewalls and segmentation to decide which plant boundaries should be online, one-way, or disconnected by default.

10A pragmatic roadmap for chemical sites

Improvement in a running chemical plant is incremental by necessity. The realistic path is to sequence work so that the highest-consequence exposures close first and nothing forces an unsafe or unplanned shutdown along the way.

• Inventory: establish a trustworthy view of OT assets, connections and the real network topology around the SIS.
• Isolate safety: confirm the SIS is in its own zone with the strictest conduits and no routable path from IT or remote access.
• Reduce reachability: replace standing inbound links with one-way transfer for reporting and monitoring data.
• Harden access: broker, time-limit and log every vendor and engineering session into the process network.
• Exercise response: rehearse cyber-aware shutdown and recovery so incident actions always end in a safe state.
• Anchor to standards: map controls to IEC 62443, IEC 61511 and NIST SP 800-82, and document residual risk like any other process hazard.

The chemical sector does not need to wait for CFATS to return to justify this work. The case is the same one process-safety engineers have always made: identify the consequence, count the independent layers, and make sure no single failure, including a cyber failure, can take more than one of them down at once.

FAQFrequently asked questions

SRCSources of record