ArchifyICS

Interactive ICS/OT cybersecurity training maps built around ISA/IEC 62443 concepts, Purdue reference architecture, and MITRE ATT&CK for ICS case studies.

ArchifyICS turns industrial cybersecurity topics into explorable, standalone diagrams that help engineers understand how the work is actually performed: assess risk, define zones and conduits, set target security levels, design controls, operate securely, respond to incidents, govern supplier access, and manage patches.

This repository is an independent educational project. It is not affiliated with or endorsed by ISA or IEC, and it does not reproduce the normative text of the standards.

Start here

Open index.html or the hosted GitHub Pages site once enabled.

The current release contains 15 interactive Archify diagrams:

#	Module	Main focus
00	62443 System of Work	How the standards families and lifecycle fit together
01	Asset Owner Security Program	Governance, scope, program operation and continual improvement
02	System Risk Assessment	SuC, initial risk, zones/conduits, detailed risk, SL-T, CRS
03	Zones, Conduits & Security Levels	Segmentation and target security requirements
04	Secure Design & Implementation	Requirements, seven FRs, architecture, controls and verification
05	Operations & Maintenance	Monitoring, change, vulnerabilities, backup and reassessment
06	OT Incident Response	Detection, safety/process impact, containment, recovery and evidence
07	Product Supplier Security Lifecycle	Secure development lifecycle and component security capability
08	Service Provider Remote Access	Authorized, monitored and revocable third-party access
09	OT Patch Management	Applicability, operational impact, testing, deployment and rollback
10	ISA/IEC 62443 Mastery Ladder	Progressive learning levels from OT foundations to architect / assessor capability
11	Purdue Enterprise Reference Architecture	Levels 0–5, Industrial DMZ, IT/OT boundaries, remote access and safety separation
12	Stuxnet Attack Path	Removable media, engineering compromise, PLC logic change, operator deception and physical impact
13	Triton / TRISIS Safety Attack Path	SIS-focused attack path, TriStation communication and potential loss of safety
14	Industroyer Substation Attack Path	Electrical-substation malware, protocol abuse, operational commands and grid impact

Learning model

ArchifyICS is designed around the practical lifecycle used in ISA cybersecurity training:

UNDERSTAND
    ↓
ASSESS
    ↓
DESIGN / IMPLEMENT
    ↓
OPERATE / MAINTAIN
    ↓
ASSURE / IMPROVE

The goal is not to memorize standard numbers. The learner should be able to move from risk → requirement → architecture/control → evidence → verification.

Repository structure

ArchifyICS/
├── index.html                 # Training Atlas home page / GitHub Pages entry
├── atlas/                     # Delivered standalone Archify HTML diagrams
├── sources/
│   ├── archify/               # Frozen typed JSON IR used to build the diagrams
│   └── receipts/              # Archify delivery receipts
├── curriculum/                # Suggested learning path
├── labs/                      # Practical OT exercises and capstone scenarios
├── agent/                     # Future small specialized tutor-agent design
├── docs/
│   ├── REFERENCES.md
│   ├── ROADMAP.md
│   └── VALIDATION.md
├── CONTRIBUTING.md
└── CHANGELOG.md

Why diagram-first training?

Industrial cybersecurity is full of relationships that are hard to teach as isolated bullet points:

• Asset Owner vs System Integrator vs Product Supplier vs Service Provider responsibilities
• system under consideration, zones and conduits
• risk assessment and target security levels
• cybersecurity requirements specification (CRS)
• the seven foundational requirements
• design, implementation and verification
• operational change, patching, backup and incident response
• product secure development lifecycle

Interactive maps make those relationships visible and allow a learner to follow the sequence of engineering decisions rather than only reading definitions.

Seven foundational requirements

The atlas uses the familiar ISA/IEC 62443 foundational requirement structure:

1. Identification and Authentication Control
2. Use Control
3. System Integrity
4. Data Confidentiality
5. Restricted Data Flow
6. Timely Response to Events
7. Resource Availability

Practical training direction

Each subject is intended to evolve into a repeatable training unit:

Concept
  ↓
Interactive workflow
  ↓
Plant scenario
  ↓
Learner decision
  ↓
Evidence / constraints
  ↓
Engineering output
  ↓
Review and assessment

Planned labs include a power-generation control system, remote vendor access, legacy Windows engineering stations, segmentation of BPCS/SIS assets, patch deferral, and an OT incident-response tabletop.

Archify

The diagrams are authored as typed JSON intermediate representations and delivered as self-contained HTML using Archify by tt-a1i.

Archify validation is intentionally part of the repository: diagrams are checked before delivery, and the frozen source JSON is kept alongside the rendered artifacts to preserve reproducibility.

Archify project: https://github.com/tt-a1i/archify

Source material and references

This project is an educational synthesis based on publicly described ISA/IEC 62443 concepts and ISA training objectives. Normative requirements must always be checked against the licensed standards applicable to the project.

Primary public references:

• ISA/IEC 62443 Series of Standards
  https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• ISA/IEC 62443 Cybersecurity Certificate Program
  https://www.isa.org/certification/certificate-programs/isa-iec-62443-cybersecurity-certificate-program
• IC32 — Using the ISA/IEC 62443 Standards to Secure Your Control Systems
• IC33 — Assessing the Cybersecurity of New or Existing IACS Systems
• IC34 — IACS Cybersecurity Design & Implementation
• IC37 — IACS Cybersecurity Operations & Maintenance
• MITRE ATT&CK for ICS — Tactics: https://attack.mitre.org/tactics/ics/
• MITRE ATT&CK for ICS — Stuxnet (S0603): https://attack.mitre.org/software/S0603/
• MITRE ATT&CK for ICS — Triton / TRISIS (S1009): https://attack.mitre.org/software/S1009/
• MITRE ATT&CK for ICS — Industroyer / CRASHOVERRIDE (S0604): https://attack.mitre.org/software/S0604/

See docs/REFERENCES.md for the reference map used by the project.

Current status

v0.2 — Training Atlas + ICS attack-path examples

• 15 interactive diagrams
• typed Archify source IR retained
• showcase validation completed for the atlas and MITRE examples
• GitHub Pages-ready entry page
• curriculum, labs and tutor-agent scaffolding
• three ATT&CK for ICS examples: Stuxnet, Triton, and Industroyer

The next milestone is v0.3 — Scenario Labs + Tutor Layer, building from the current ATT&CK case studies toward hands-on exercises, mapping MITRE ATT&CK for ICS to Purdue and ISA/IEC 62443, and eventually a small specialized ICS/OT tutor agent.

Important note

ArchifyICS is a training and engineering-learning aid. It is not a substitute for:

• licensed ISA/IEC 62443 standards
• site-specific cybersecurity risk assessment
• process safety / functional safety engineering
• vendor/OEM requirements
• regulatory or contractual requirements
• formal certification or audit guidance

Use the official standards and qualified engineering judgment for real projects.