Safety instrumented system (SIS)

A SIS is the last automated layer of protection before physical safeguards such as relief valves. The 2017 TRITON/TRISIS malware targeted safety controllers in a petrochemical plant, showing that attackers can aim at safety systems directly.

For an OT SOC, two rules follow: monitor all engineering access to safety controllers closely, and never let response actions interfere with the SIS without explicit approval from process safety.