NO EXPLOIT REQUIRED

Two Separate Campaigns Are Being Reported as One — and the Public Record Still Cannot Explain Why the Pumps Stopped

Scope Note

This assessment addresses the campaign against internet-exposed programmable logic controllers in the U.S. Water and Wastewater Systems sector that began on or about 26 July 2026. It has three purposes.

▪ To correct a specific and consequential technical error now circulating widely in open-source coverage and in vendor commentary: the attribution of CVE-2021-22681 to the controllers named in the FBI advisory.

▪ To reconstruct the exploit chain from primary documents only, and to identify precisely where the public record stops explaining the observed physical effects.

▪ To separate what is documented from what is inferred, and to state confidence honestly where the two diverge.

This report deliberately does not repeat the state-count coverage that has dominated reporting since 30 July. The count is a weak metric and, as Section 6 argues, a misleading one. Where victim disclosures are used, they are used as evidence about detection and classification behavior, not as a scoreboard.

Two conventions apply throughout. First, no inline citations appear in the body text; every source is registered and graded in Annex B. Second, analytic inferences are marked as such in the text. Where a mechanism is proposed but not documented, it is labeled an inference and the competing hypotheses are stated.

Key Judgments

Confidence levels follow ICD 203. Confidence reflects the strength of the evidentiary base and the soundness of the reasoning, not the probability of the event.

1. The Conflation

The single most consequential error in current reporting is the attribution of CVE-2021-22681 to the controllers named in the 30 July federal advisory. It appears in vendor blog posts, in aggregator coverage, and in at least one widely circulated practitioner briefing. It is wrong, and correcting it changes the character of the story.

1.1 What CVE-2021-22681 actually affects

CVE-2021-22681 is an authentication bypass affecting the Rockwell Logix controller family. The vulnerability lies in a shared secret key used to authenticate the engineering workstation to the controller; an actor who extracts that key can connect without valid credentials. There is no vendor patch. The affected product list, verified against the National Vulnerability Database, the corresponding CISA ICS advisory, and Rockwell’s own advisory, comprises the Logix line:

CompactLogix 1768, 1769, 5370, 5380, 5480

ControlLogix 5550, 5560, 5570, 5580

GuardLogix 5560, 5570, 5580 / Compact GuardLogix 5370, 5380

DriveLogix 5560, 5730, 1794-L34 / FlexLogix 1794-L34 / SoftLogix 5800

Software: RSLogix 5000 v16-20, Studio 5000 Logix Designer v21+, FactoryTalk Security v2.10+

MicroLogix 1100 and MicroLogix 1400 are not on that list. They are not affected.

1.2 Why they cannot be

The two families are different architectures. Logix controllers are programmed through RSLogix 5000 or Studio 5000 Logix Designer and use the shared-key mechanism that the CVE defeats. MicroLogix controllers are programmed through RSLogix 500 or RSLogix Micro. They have a different firmware architecture, a different engineering toolchain, and a different communication stack.

There is no shared-key authentication on a MicroLogix to bypass, because there is no authentication mechanism in the protocol at all. This is not a defect introduced by an attacker; it is how the product works. CIP explicit messaging on the MicroLogix 1100 and 1400 carries no built-in authentication. The optional controller password is a feature the integrator must configure. If nobody configures it, the controller answers whoever asks.

Rockwell’s own recovery guidance published on 30 July corroborates the architecture: the documented procedure for regaining access to a locked-out MicroLogix 1400 involves clearing controller memory by battery removal and then redownloading the project through RSLogix 500. Studio 5000 does not appear, because Studio 5000 does not talk to these devices.

1.3 The two campaigns, separated

The gap between these two rows is not a difference in skill within one operation. It is a difference in objective. Campaign 1 is reading the plant — extracting and studying the logic that governs physical processes, which is reconnaissance for something later. Campaign 2 is walking through unlocked doors and turning off the lights.

Both may ultimately prove to be Iranian-affiliated. Section 9 addresses that question on its merits. But the assessment that Campaign 2 is “aligned with” Campaign 1 rests entirely on sector and timing. It does not rest on device family, tooling, access method, or any published indicator overlap — and analysts repeating the alignment language should say which of those they are relying on.

2. What the Federal Advisories Actually Say

Three primary documents were published on 30 July 2026: the FBI and EPA joint Public Service Announcement, the CISA sector alert for water and wastewater, and Rockwell Automation’s recovery notice SD1790. Read together they describe the campaign more precisely than any secondary account.

2.1 The sentence that reframes the campaign

Actors are targeting internet-exposed PLCs to remotely tamper with device configurations by changing IP addresses and turning on and setting passwords, resulting in a loss of view, and in some cases function, of connected equipment in targeted facilities.

FBI / EPA Public Service Announcement, 30 July 2026 — threat landscape section

Read the verb. The actors turned password protection on. They did not defeat it, guess it, or crack it. They enabled a feature that the operators had left unconfigured, and then set a value the operators did not know.

That single construction eliminates three hypotheses at once. It rules out credential brute force, because there was nothing to brute force. It rules out default-credential abuse, because a default credential is still a credential and would already have been on. And it rules out vulnerability exploitation, because no vulnerability is required to reach an unauthenticated control interface.

Rockwell’s SD1790 uses the same construction independently, describing actors tampering with device configurations by changing IP addresses and turning on and setting passwords. Two organizations with different equities — a federal law-enforcement agency and the manufacturer of the affected product — chose the same phrasing.

2.2 A note on evidentiary weight

The CISA sector alert describes actors who modified passwords to lock out operators and disconnected the controllers by changing their IP addresses. That language is weaker for this argument. To modify a password can mean changing one that already existed. CISA’s mitigation guidance directs operators to enable password protection and change default passwords, which is consistent with the reading advanced here but not dispositive on its own.

This assessment therefore rests the no-authentication finding on one government primary source — the FBI language — corroborated by the vendor notice and by the documented behavior of the hardware. That is a strong basis. It is not two independent government confirmations, and it is not presented as such.

2.3 What else the advisories disclose

Four further items in the primary documents have received little attention and carry more analytic weight than the state count.

Project file modification

The FBI states that at least one organization reported modified PLC project files after noticing ladder logic discrepancies across several sites. This is not configuration tampering. It is alteration of the control program itself — the logic that decides when a pump runs, when a valve opens, and when an alarm fires. It was detected by a human noticing that the running program did not match expectation, across multiple locations.

Third-party configuration reuse

The advisory notes that similarities in network setup provided by third parties may give actors the opportunity to multiply successes where vulnerable network and hardware configurations exist across customers. Section 5 treats this as the campaign’s actual scaling mechanism.

End-of-life posture

The FBI devotes a full mitigation section to end-of-life replacement planning, including maintaining a rolling twelve-month EOL forecast reviewed quarterly and tracking EOL systems by product, owner, location, and retirement date. Federal advisories do not include procurement-lifecycle guidance by accident. Its presence is a quiet statement about the status of the affected controllers.

Key switch position

Operators are told to place physical and software key switches in the run position to block unauthorized changes to logic, configuration, and firmware, and to validate project files before switching back to run. Rockwell independently recommends setting the controller to run mode via the front-panel keypad. Mode manipulation is in scope.

3. The Hardware

Understanding why this campaign required nothing requires understanding what was on the other end of the connection.

3.1 Device profile

The MicroLogix 1100 and 1400 are compact controllers built for small automation tasks: a lift station, a booster pump, a chlorine dosing skid, a tank-level loop. They are inexpensive, physically small, and widely deployed across small and mid-size municipal water systems precisely because they are inexpensive and small. A rural district with two operators and no IT department runs on devices like these.

They expose EtherNet/IP with CIP explicit messaging. The relevant surface, per the manufacturer documentation:

Note what is absent from that table: Modbus TCP on 502 and S7comm on 102 appear in several published analyses of this campaign. Those are Schneider Electric and Siemens protocols respectively. They are not relevant to a MicroLogix and their inclusion is a symptom of the same conflation described in Section 1.

3.2 Exposure baseline

Internet-wide scanning conducted on 30 July 2026 — the day the advisories were issued — characterized vendor-level exposure as follows.

4. Loss of View Is Not Loss of Function

This section contains the finding that, in the author’s assessment, no other published analysis has addressed. It concerns a gap in the public record rather than a fact within it.

4.1 The distinction the FBI draws

The federal description of the outcome is precise: the tampering resulted in a loss of view, and in some cases function. Two different consequences, explicitly separated, with the second qualified as occurring only sometimes.

Rockwell’s notice is more conservative still. It describes the result as a loss of operator view, without reference to function at all. A manufacturer describing damage to its own installed base has every incentive toward precision, and it declined to claim function loss.

4.2 Why the documented TTPs cannot produce the physical effects

Consider what changing a controller’s IP address actually does. The SCADA system can no longer poll the device. The human-machine interface goes blank or stale. The operator loses visibility.

The controller keeps running. A MicroLogix in run mode executes its ladder logic on every scan cycle regardless of whether anything upstream can reach it. The pump does not stop because the operator stopped watching. Local control loops continue. Setting a password on the controller has the same character — it prevents authorized personnel from making changes, but it does not alter the program already executing.

Yet operational effects reported to the FBI included loss of pressure and flooding. Something else happened at those sites.

4.3 Competing hypotheses for the function loss

Three mechanisms could bridge the gap. They are not mutually exclusive and different victims may have experienced different combinations. All three are inferences drawn from mitigation guidance and process engineering; none is documented as observed.

Hypothesis A — Mode change

The controller was taken out of run mode, halting ladder logic execution outright. Supporting indicator: both the FBI and Rockwell independently emphasize returning key switches to the run position, and the FBI adds that project files should be validated before doing so. Mitigation guidance is written against observed behavior. This is the best-supported of the three.

Hypothesis B — Logic modification

The control program itself was altered. Supporting indicator: the confirmed report of modified project files and ladder logic discrepancies across several sites at one victim. Changing pump start and stop conditions, or altering setpoint comparisons, produces pressure effects directly and would persist through a reboot. This is the most dangerous of the three because it survives the obvious remediation.

Hypothesis C — Architecture dependency

The control scheme depended on network reachability. In multi-site municipal systems it is common for remote setpoints, tank-level telemetry, or lead-lag pump coordination between booster stations to traverse the network. Sever the path and the local logic falls through to a default state — which, in a poorly specified system, may be a stopped pump. Under this hypothesis, an IP address change alone is sufficient to produce pressure loss, but only because the design made view and control the same thing.

For the Georgia victim where multiple pump stations went down at approximately one in the morning, Hypothesis C is the most parsimonious explanation for simultaneity, with A or B available as aggravators. Independent per-device tampering across several stations within a narrow window is less economical than a single change affecting a shared path or a shared configuration.

This is an inference. The affected utility’s own public language is that unauthorized cyber activity may have caused or contributed to the disruption. The word may is theirs, and it should not be removed in retelling.

4.4 Why this matters operationally

If Hypothesis C is correct at any material number of sites, the defensive implication is uncomfortable. Removing controllers from the public internet — the central recommendation of every advisory — closes the access path but does nothing about a control architecture in which loss of communications equals loss of process. Those systems will fail the same way during a fiber cut, a carrier outage, or a misconfigured firewall change.

If Hypothesis B is correct at any material number of sites, then utilities that restored service by resetting passwords and restoring connectivity may still be running modified logic. The FBI’s guidance to compare running programs against known-good logic using vendor integrity tools, and to verify backups before redeployment, is not boilerplate. It is the only step that finds this.

5. The Scaling Mechanism Is Procurement

The question that has driven most coverage is how an adversary struck dozens of utilities across multiple states within roughly forty-eight hours. The assumed answer is coordination and capability. The advisories suggest a duller and more troubling answer.

Across several victims, similarities in network setup provided by third parties may provide actors the opportunity to multiply successes when vulnerable network and hardware setups exist across customers.

FBI / EPA Public Service Announcement, 30 July 2026

That is a description of integrator monoculture. A regional systems integrator serving small municipal utilities does not design each installation from scratch. It has a reference architecture: the same controller model, the same address scheme, the same remote-access arrangement, the same unconfigured optional password. It deploys that template across every customer in its book because standardization is what makes small-utility automation affordable.

An adversary who characterizes one such installation has characterized all of them. No coordination is required to hit twenty sites simultaneously if twenty sites are the same site.

5.1 The cellular modem problem

CISA identifies a specific vector within this pattern. Its alert warns that even water organizations with mature cybersecurity processes should validate their external connections, because the targeting includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.

This is the mechanism by which a utility can be exposed without knowing it is exposed. The modem is installed by a contractor to enable remote support on a remote asset. It is billed to operations rather than IT. It does not appear in the asset inventory, it does not appear in the external scan because the scan enumerates the utility’s own address space, and the carrier-assigned address it lives on belongs to nobody the utility recognizes.

One of the Minnesota disclosures is instructive here: the affected municipality reported disconnecting cellular-connected equipment at two water towers and several wastewater lift stations. The response action names the vector.

5.2 The regulatory consequence

If the exposure originates with integrators rather than with utilities, then guidance addressed to utilities will underperform. The federal advisories were issued to asset owners and operators. CISA’s alert is notable for explicitly addressing integrators alongside owners and operators — a small drafting choice that recognizes where the defect actually lives.

There is currently no mechanism that reaches those firms. Water sector cybersecurity requirements remain voluntary at the federal level. A small integrator serving forty rural districts across three states is subject to no security baseline, no attestation requirement, and no audit. It is, functionally, an unregulated single point of failure for the drinking water of tens of thousands of people, and the July campaign is the first large-scale demonstration of what that means.

6. The Denominator Problem

Coverage has converged on a number: seven states per the FBI, at least twelve per anonymously sourced reporting. Both figures are being used as though they measure the campaign. They do not. They measure detection.

6.1 What the two figures actually count

The federal figure counts utilities that reported an incident to the FBI. The higher figure counts states responding to possible intrusions. These are different denominators, and the difference between them is not evidence of five new states. A jurisdiction can be responding without having filed, and a utility can have filed without the state being aware.

6.2 The seven-day reclassification

The most instructive event in the entire public record is not a large incident. It is the sequence at a Georgia utility.

Seven days elapsed between the physical effect and its reclassification. For that week the event existed in the record as a pump failure. It entered the campaign only because someone went back and asked why several stations failed at one in the morning.

6.3 The implication

Every utility in the country that experienced an unexplained pressure event during the last two weeks of July has a decision to make about whether to look. The ones with operational-technology monitoring, a fusion-center relationship, or a state cyber unit will look. The ones without — which is most small systems, and there are on the order of one hundred fifty thousand public water systems in the United States — have already closed the ticket.

This produces a systematic bias in the victim set. The confirmed victims are not a random sample of the affected population; they are a sample of the monitored population. The campaign is visible where instrumentation exists, and the instrumentation correlates with size and budget. The smallest and least-defended systems, which are also the most likely to be running unconfigured controllers on cellular modems, are precisely the systems least able to know.

7. Detection Asymmetry: Who Found It

A second underexamined feature of the record is the question of who discovered each incident. The answer varies, and the variation is diagnostic.

The Columbus case is the one that deserves scrutiny. A federal agency contacted a municipal utility and told it that it had a problem. That means CISA possessed host-specific or victim-specific knowledge before the victim did.

There are several ordinary explanations. Scan-and-notify programs identify exposed assets and contact owners. Infrastructure seizure or sinkholing yields victim lists. Intelligence sharing from a partner service can produce target lists. A telemetry partnership with a scanning vendor can flag newly changed device configurations. The agency has not said which, and it is under no obligation to.

The analytic point stands regardless of mechanism: federal visibility into this campaign exceeded sector visibility, and at least one utility learned it was a victim only because the government told it. That should inform how much weight anyone places on the completeness of the public victim register. It should also inform how utilities think about the value of being reachable — the notification only works if there is somebody to call.

8. Intent

Most coverage has framed the operational effects as disruption. Two documents, produced independently and for different audiences, suggest the framing is wrong.

8.1 The convergence

A state bureau of criminal apprehension memorandum, distributed to law enforcement during the first week and subsequently obtained by a national news organization, assessed that the likely desired impact of the intrusions at the water facilities was to cause loss of system pressure and subsequent potential contamination of the water supply.

The federal advisory, written for asset owners and making no claim about intent, states that operational effects reported to the FBI included loss of pressure and flooding, and that pressure loss in water systems could potentially allow untreated ground water to seep into pipes.

One document describes an assessed objective. The other describes a physical consequence. They describe the same causal chain, from opposite directions, without reference to each other.

8.2 The engineering

The chain is not speculative. A pressurized distribution system holds contaminants out by maintaining positive pressure differential against the surrounding environment. Municipal water mains are buried in soil that also contains sewer lines, and the joints of aging distribution piping are not hermetic. Positive pressure is the barrier.

When pressure drops below the required threshold, that differential can reverse. Groundwater, soil moisture, and in the worst case sewage can be drawn into the main through joints, cracks, and cross-connections. This is why a boil-water advisory is the mandated response to a low-pressure event in most jurisdictions — not because contamination has been detected, but because the barrier that prevents it has been lost.

Understood this way, the boil-water advisories issued during this campaign were not precautionary theater. They were the correct engineering response to a condition an adversary appears to have engineered deliberately.

8.3 What follows

If pressure reduction was the objective rather than a byproduct, three things change.

▪ The physical-effects subset is not the tail of the campaign. It is the campaign, and the loss-of-view-only victims are the failures — sites where the actor got in but could not reach the process.

▪ Target selection was informed. Choosing pressure-control assets over, for example, billing systems or SCADA historians requires knowing which controller does what. That is a small amount of knowledge, but it is not zero.

▪ The reassurance that no contamination has been reported is weaker than it sounds. Detection depends on sampling programs and on instrumentation that, at some sites, the actor had reached. Absence of reported contamination is not the same as absence of contamination, particularly where a pressure event went a week without being recognized as an attack.

That last point should be stated carefully and not overstated. There is no evidence in the public record of any contamination event, and multiple state agencies have affirmed water quality. The claim here is narrower: the confidence interval around that affirmation is wider than the coverage implies.

9. Attribution

9.1 Where the record stands

No U.S. government agency has formally attributed the July campaign to any actor. The FBI and EPA advisory refers only to malicious cyber actors and names no country or group. State agencies in the most heavily affected jurisdictions have likewise declined to attribute. A national newspaper reported a preliminary government assessment pointing toward Iranian actors, explicitly labeled preliminary and subject to change.

A leaked water-sector information-sharing memorandum cites a state fusion center assessing the activity as aligned with the campaign described in the April federal advisory. That assessment does not present attributing evidence, and as Section 1 establishes, the alignment claim rests on sector and timing rather than on hardware, tooling, or indicator overlap.

Private-sector research organizations assess the tradecraft as consistent with an IRGC-affiliated persona tracked under several names across vendors. That persona has a documented history in this sector, including default-credential attacks against Israeli-manufactured controllers at a Pennsylvania municipal water authority in 2023 and subsequent development of a custom control-system malware platform. Six IRGC officials were sanctioned in February 2024 in connection with that activity.

Political commentary has diverged from the analytic picture in both directions and is not treated as evidence in this assessment.

9.2 The capability paradox

The temptation is to reason from sophistication. The reasoning does not work in either direction, and it is worth being explicit about why.

Arguing that the campaign is too crude to be a state actor fails because crudeness is a feature. An operation that requires no exploit, no custom tooling, and no malware leaves no development fingerprint, consumes no sensitive capability, and can be disowned. A state service seeking deniable effect against soft infrastructure would rationally choose exactly these methods. Burning a real exploit on a rural lift station would be poor tradecraft.

Arguing that the campaign must be a state actor because of the coordination also fails, because Section 5 shows the coordination may be an artifact of integrator monoculture rather than of the operation.

What remains is a genuine widening of the suspect pool. When the capability barrier approaches zero, the population of actors capable of executing the campaign includes state services, affiliated proxy groups, ideologically motivated individuals, and opportunists imitating a publicly described playbook. Reporting on a coordinating structure for dozens of affiliated hacktivist groups, established at the outset of the current conflict, is directly relevant: it describes a mechanism by which state-adjacent intent and unskilled execution combine.

9.3 The misdirection problem

Investigators are reported to be examining whether indicators were arranged to implicate Iran falsely. That concern is proportionate for a straightforward reason: cheap operations are cheap for everyone. Where an operation requires a bespoke exploit chain, false-flagging is expensive and the artifacts betray the forger. Where an operation requires a scan and a protocol client, any actor can produce a perfect imitation of any other actor, because there is nothing distinctive to imitate.

This is the structural reason attribution here is hard, and it is likely a significant part of why the FBI declined to name anyone in a document otherwise rich in technical detail.

9.4 Assessment

10. Victim Register

Entries are graded by disclosure quality rather than by severity. An event confirmed by a named official at a state agency is not equivalent to one relayed by anonymous federal sources, and a register that presents both in the same column is misleading.

11. Outlook and Indicators

11.1 What to expect

▪ Additional victim disclosures over the next two to three weeks, driven by retrospective review rather than by new intrusions. The Georgia reclassification is a template others will follow.

▪ Divergence between the federal count and press counts will persist, because they measure different things and neither agency has an incentive to reconcile them publicly during an active investigation.

▪ Pressure on the voluntary-compliance model. State-level action is already visible in grant programs and in at least one state’s move toward mandatory minimum standards. Federal mandatory requirements remain unlikely in the near term given the legal history.

▪ Vendor and integrator exposure. The manufacturer has engaged publicly. The unexamined party is the systems-integrator channel, and the first litigation or state enforcement action naming an integrator would be a significant development.

11.2 Indicators that would change this assessment

Annex A — Practitioner Guidance

This annex is written for defenders with operational-technology exposure. It is not limited to water utilities; the failure modes described here exist wherever legacy controllers are reachable.

A.1 Triage — was this us?

Work the following in order. Steps one through three are the retrospective review that the Georgia case shows most organizations have not performed.

▪ Review every unexplained process event between 20 July and the present. Pressure anomalies, unexpected pump stops or starts, lift station high-level alarms, flooding, communications dropouts logged as equipment faults. Any event closed as a mechanical failure without a confirmed root cause is a candidate.

▪ Reconcile the controller inventory against reality. Enumerate every PLC by model, firmware, physical location, and network path. Compare against the documented inventory. Discrepancies at this step are the finding.

▪ Enumerate every cellular modem, radio, and vendor-installed remote access path. Purchase orders, contractor invoices, and carrier billing records find devices that network scans miss. This is the highest-yield single action in the annex.

▪ Check controller password state, not password strength. The question is whether protection is enabled at all, and whether the enabled value is one your organization set. A password you did not configure is an indicator of compromise.

▪ Verify key switch position across the fleet. Anything not in run mode requires an explanation. Reconcile against change records.

▪ Compare running logic against known-good project files. Use vendor integrity checking tools and visually compare. Pay particular attention to reusable code modules and to I/O configuration. Verify any backup before restoring it — a backup taken after the intrusion window is not a clean backup.

▪ Review logs on everything adjacent. Modems, HMIs, engineering workstations. If evidence suggests the actor reached additional devices, reimage them rather than cleaning them.

A.2 External exposure discovery

Attack-surface enumeration scoped to your own address space will not find integrator-installed cellular assets, because those live on carrier ranges. Search by device fingerprint instead, then correlate to your sites by banner content, certificate fields, and geolocation.

Model the carrier ranges as well. If a contractor provisioned modems on a business account, the organization field on those hosts is the carrier, not you — which is exactly why they never appeared in your scans.

A.3 Detection content

Network-side. If OT traffic traverses a sensor, these are the events worth alerting on. Baseline first; several are normal during scheduled maintenance and will generate noise otherwise.

Process-side. The most reliable detection for this campaign is not on the network. It is a correlation rule between the process historian and the network sensor: any pressure or level excursion that coincides within minutes of a controller communications change should raise a case, regardless of whether either signal alone crosses a threshold. Most utilities have both data sources and correlate neither.

A.4 Remediation sequence

▪ Remove the controller from direct internet reachability before anything else. Broker all remote access through a gateway or jump host that terminates and inspects the session. Do not simply place a NAT in front of it.

▪ Confirm you hold a known-clean controller image before attempting password recovery, because recovery on these devices clears memory. Recovering first and discovering afterward that no clean backup exists is the worst outcome available.

▪ Follow the manufacturer’s published recovery procedure for locked controllers. Treat the recovered device as untrusted until its logic is validated.

▪ Set and document controller passwords. On these platforms the first question is whether protection is enabled, not whether the value is strong.

▪ Apply access control lists at the controller and at the network so that only named engineering assets can originate sessions.

▪ Return key switches to run and validate project files before doing so, since the mode transition commits whatever is currently loaded.

▪ Exercise manual operations. The utilities that came through this campaign without service impact are, without exception, the ones whose staff could run the plant by hand.

▪ Plan the replacement. These are end-of-life controllers. Compensating controls are a bridge to decommissioning, not a substitute for it — maintain a rolling twelve-month forecast and hold firm retirement dates.

A.5 The architectural question

One item does not belong on a checklist because it cannot be completed in a sprint. Section 4 raises the possibility that at some victims, loss of communications produced loss of process because the control scheme made them the same thing.

Every operator should be able to answer one question about every remote asset: if the network path to this device disappears right now, what does the process do? If the answer is unknown, or if the answer is that the pump stops, then the site has a design problem that no amount of network security will address. That failure mode will recur during the next fiber cut whether or not an adversary is involved.