SCADA security conversations mix database jargon, cryptography, industrial protocols, and audit-world terminology in a single vendor call - and the person who doesn't know what a blind index or a Type II attestation is loses the negotiation. This glossary defines the terms OT engineers and compliance leads actually encounter when evaluating, securing, or auditing a SCADA platform, grouped into eight categories so you can jump straight to what you need. Definitions are short, conservative, and practitioner-focused: what the term means, why it matters, and what to watch for.
One of 60+ guides in our SCADA security and compliance series.
Use this page the way you would use a checklist: skim the category headings, read the terms that show up in your next RFP or vendor call, and follow the links for the deep-dive guides. If you want the full picture of what to demand from a cloud SCADA vendor, start with our cloud SCADA security checklist and come back here whenever a term needs unpacking.
An authorization model where permissions attach to roles - viewer, operator, engineer, admin - and users inherit permissions through role assignment rather than individual grants. In SCADA, the critical question is whether RBAC governs control actions (setpoint writes, command execution) and site-level scope, not just which screens a user can see.
Requiring two or more independent proofs of identity - something you know (password), something you have (phone or hardware key), something you are (biometric) - before granting access. A password alone protecting remote access to process control is no longer a defensible posture in any security framework.
The six-digit rotating codes generated by authenticator apps, computed from a shared secret and the current time and typically valid for 30 seconds. TOTP is the most widely deployed second factor; its main weakness is that codes can be phished in real time, which is why hardware-bound factors are stronger.
A phishing-resistant authentication standard where a hardware key or device-bound credential signs a challenge that is cryptographically tied to the genuine website's origin, so a look-alike phishing site cannot capture anything reusable. Passkeys are the consumer-friendly form of the same standard.
Requiring a fresh, stronger authentication check at the moment a user attempts a high-risk action - signing a work permit, changing a critical setpoint - even if they already hold a valid session. It limits the damage a hijacked or unattended session can do.
The principle that every account, service, and device gets the minimum access required for its task and nothing more. In OT terms: the contractor viewing compressor trends should not inherit the ability to change a shutdown setpoint.
The ability to terminate a user's active sessions immediately - on logout-everywhere, on offboarding, or on suspected compromise - rather than waiting for tokens to expire on their own. Related controls include session expiry, concurrent-session limits, and forced re-authentication.
Detecting repeated failed login attempts and locking the targeted account (or throttling the source) so password guessing becomes impractical. Persistent lockout with alerting is stronger than a silent temporary delay, because repeated failures are also a detection signal worth investigating.
The classic reference architecture that layers an industrial network into levels: field devices at Levels 0–1, control and HMIs at Levels 2–3, a DMZ at Level 3.5, and business IT at Levels 4–5. It remains the shared vocabulary for OT segmentation even as cloud connectivity reshapes the upper levels - see our secure SCADA for OT networks guide for how modern architectures map onto it.
IEC 62443's generalization of segmentation: a zone is a group of assets sharing common security requirements, and a conduit is the controlled communication path between zones. Every zone crossing should pass through an explicitly defined, minimally permissive conduit.
A buffer network segment between OT and IT (or the internet) where shared services - historians, patch servers, data mirrors - live, so that no direct connection ever runs from the outside world to a control device. Traffic terminates in the DMZ and is re-originated, never passed straight through.
A hardware device that physically enforces one-way data flow, typically out of the OT network, making inbound traffic impossible rather than merely blocked by policy. Diodes are the gold standard for high-security unidirectional monitoring (IEC 62443 SL3–SL4 environments) but cost thousands per link and rule out remote configuration.
An edge device inside the OT network that initiates every connection outward to the platform over TLS, so the site firewall can deny all inbound traffic permanently - nothing listens, so internet scanners find nothing. The Merobix gateway works on this model, polling PLCs and RTUs locally and pushing encrypted data out with zero inbound firewall rules.
Complete physical isolation of the OT network from the internet and corporate IT. An air gap eliminates remote network attack paths but is not security by itself - USB media, laptops, and insiders still cross it (Stuxnet's lesson) - and it shifts patching and monitoring burden entirely onto the operator.
Enforcing fine-grained network policy between individual workloads or devices rather than only at large zone boundaries, so lateral movement after a single compromise is contained. In OT it complements, rather than replaces, Purdue-style zoning.
A hardened, monitored intermediary server that administrators must pass through to reach OT systems, concentrating access control, session recording, and audit onto one chokepoint. A jump host is only as strong as its own patching and authentication.
An encrypted tunnel that extends network access to a remote user or site. VPNs are better than exposed ports but grant network-level access once inside, and internet-facing VPN concentrators are themselves a frequent CVE target - one reason outbound-only architectures have gained ground for SCADA access.
The protocol that encrypts and authenticates data in transit - the "s" in https and the standard protection for cloud, MQTT, and remote industrial connections. Evaluation questions worth asking any vendor: which TLS versions are accepted, and how are certificates issued and rotated.
Encrypting stored data - databases, backups, disk volumes - so a stolen disk or leaked snapshot does not expose plaintext. Disk-level encryption protects against physical theft; application-level encryption additionally protects against some classes of database compromise.
Encrypting specific sensitive fields (credentials, personal identifiers) inside the application before they reach the database, so even a user with raw database access sees ciphertext. It is finer-grained than whole-disk encryption and survives database-layer leaks.
A keyed hash stored alongside an encrypted field that lets the application search for exact matches - find the account with this email - without ever decrypting or exposing the underlying values. It solves the classic problem that encrypted columns cannot otherwise be queried.
Storing a one-way, salted, deliberately slow transform of a password (bcrypt, scrypt, Argon2) instead of the password itself, so a database breach does not directly yield credentials. Fast hashes like MD5 or SHA-1, and any form of reversible storage, are disqualifying answers from a vendor.
A modern elliptic-curve digital signature algorithm valued for small keys, fast verification, and strong security margins. It is well suited to constrained edge devices, which is why it appears in device-identity and telemetry-signing designs.
A cryptographic proof, computed with a private key and checked with the matching public key, that a message came from the claimed sender and was not altered in transit. Unlike encryption, a signature proves origin and integrity rather than hiding content.
A message wrapper in which each telemetry payload is digitally signed by the originating device and carries metadata - sequence number, timestamp, sample ID, payload digest - that the platform verifies before accepting the data. Merobix devices generate Ed25519 signing identities and sign MQTT telemetry envelopes this way; our telemetry integrity guide covers the design in depth.
Capturing legitimate traffic and retransmitting it later so the system accepts stale data or repeats an old action - for example, replaying a normal tank-level reading to mask an overflow. Sequence numbers, timestamps, and unique sample IDs inside signed envelopes let a receiver reject messages it has already seen.
A cryptographic hash of the message body included in (and covered by) the signed envelope, so any modification of the payload - even one bit - invalidates verification. Digests also enable end-to-end integrity checks across queues and storage hops.
A number used once (nonce) or a monotonically increasing counter (sequence number) embedded in messages so duplicates and replays are detectable. Gaps in a sequence are themselves a signal: they can reveal dropped, suppressed, or injected traffic.
Storing only a one-way hash of secrets like password-reset links, registration tokens, or API keys, so a database leak does not hand attackers usable credentials. The system verifies a presented token by hashing it and comparing - the plaintext exists only in the user's hands.
An architecture where one application and infrastructure stack serves many customer organizations (tenants), each seeing only its own data. It is what makes cloud SCADA economical - and what makes tenant isolation the single most important security property to verify.
The set of controls that keep one tenant's data, users, and actions invisible and unreachable from every other tenant: application-level authorization checks, database-level enforcement, and monitoring for cross-tenant access attempts. Strong platforms enforce it in multiple independent layers so no single bug is sufficient to breach it.
A database feature that attaches a filter policy to tables so every query a session runs can only touch rows belonging to its own tenant - enforced by the database engine, independent of application code. Merobix applies PostgreSQL RLS to customer-owned records with a signed request context, so even an application bug cannot silently widen a query across tenants.
A tenant whose workload degrades performance for others sharing the same infrastructure - a heavy report, a runaway poll rate. It is an availability concern rather than a confidentiality one, addressed with quotas, rate limits, and resource isolation.
The explicit division of security duties between a cloud vendor (platform patching, infrastructure, tenant isolation) and the customer (user management, role assignments, site network hygiene). Every cloud SCADA contract should state this split per layer in writing; ambiguity here is where incidents fall through the cracks.
An explicit, deliberately maintained list of the tags a platform is permitted to write to - everything not listed is read-only by default. It converts remote control from an open capability into a reviewed, enumerated exception.
Engineering limits validated before a write is dispatched, so a typo or a compromised session cannot command a value outside the safe range for that tag. Bounds checking belongs in the platform, not only in the PLC.
Designing commands so that accidental duplicates - a retry after a timeout, a double-click - produce the same result as a single execution instead of repeating the action. In control systems, idempotency keys and duplicate detection prevent a network hiccup from becoming a double actuation.
An explicit lifecycle for every control action - pending, applied, verified, failed, expired - so operators and audit records always know whether a command actually reached the process. "We sent it" and "the device did it" are different facts, and mature platforms track both.
After writing a setpoint, reading the value back from the device to confirm the process actually received it, where the protocol supports it. It closes the loop between intent and effect and catches silent write failures.
A formal review-and-approval workflow required before modifications to equipment, procedures, or control parameters, standard in process-safety regimes such as OSHA PSM. In SCADA terms, an MOC gate means certain changes cannot be dispatched until the designated approvals exist.
A documented check, performed before restarting a process after modification or maintenance, confirming the system is safe to run and that MOC actions are complete. Platforms can enforce PSSR gates by blocking specified operations until the review is signed off.
The 1979-vintage protocol still ubiquitous on PLCs and RTUs, in serial (RTU) and TCP forms. It has no authentication and no encryption, so security comes entirely from the network around it: isolation, gateways, and monitoring.
A modern industrial interoperability standard with security designed in - certificate-based authentication, signing, and encryption modes up to SignAndEncrypt. Its practical weak spot is certificate management discipline: anonymous endpoints and blindly trusted certs undo the design.
A lightweight publish/subscribe messaging protocol widely used to move telemetry from edge to cloud over unreliable links. Secured properly it runs over TLS with per-device credentials and topic-level access control lists; payload-level signing adds integrity beyond the transport.
A specification that adds structure to MQTT for industrial use: defined topic namespaces, birth and death certificates for session state, and a compact payload encoding. It standardizes interoperability but does not itself add cryptographic protections beyond the underlying TLS.
A protocol common in water and electric utilities, designed for reliable telemetry over poor links. Its Secure Authentication extension (SAv5) adds cryptographic verification of critical operations, though deployment across real fleets remains gradual.
The dominant protocol in building automation - HVAC, access, energy systems - increasingly relevant as facility and industrial monitoring converge. Classic BACnet/IP has minimal security, so segmentation and gateway patterns carry the load.
An industrial Ethernet protocol built on CIP, standard on Allen-Bradley and much North American factory equipment. Like most industrial protocols it was designed for trusted networks; CIP Security exists but adoption in the installed base is limited.
The central platform - Splunk, Sentinel, QRadar and peers - that aggregates security events across an organization for correlation, alerting, and investigation. SCADA platforms that export authentication, authorization, and control events to a SIEM stop OT from being a blind spot in enterprise monitoring.
Systems that flag suspicious activity, either by matching known-bad signatures (classic IDS) or by learning normal behavior and alerting on deviations (anomaly detection). In OT, anomaly detection extends beyond network traffic to telemetry patterns, auth failures, and unusual control activity.
The chronological record of who did what, when, and from where - logins, failed logins, configuration changes, setpoint writes, acknowledgements - each attributed to a named account. It is the first thing regulators, insurers, and incident responders ask for.
Audit records where each entry cryptographically incorporates a hash of the previous one, so any after-the-fact edit or deletion breaks the chain and is detectable. This upgrades a log from "a table someone with database access could rewrite" to tamper-evident evidence.
A reliability design where notifications and events are first written durably to a database table in the same transaction as the triggering change, then delivered by a separate worker with retries. It guarantees that a crash between "alarm raised" and "message sent" cannot silently lose the alert.
A holding area for messages that repeatedly failed delivery, kept for inspection and reprocessing instead of being dropped. For security notifications and alarms, a monitored dead-letter queue is the difference between a delivery failure you investigate and one you never learn about.
A deliberate, continuous end-to-end test signal - a synthetic alert sent through the real delivery path, a token planted where no legitimate process should touch it - whose failure or triggering reveals a problem before a real event does. Provider canaries verify that SMS and email alerting actually works right now, not just at setup.
A decoy system or credential that serves no production purpose, so any interaction with it is by definition suspicious. In OT, honeypot PLCs and fake engineering shares provide high-signal, low-noise intrusion detection.
The prepared, practiced process for handling a security event: detection, containment, eradication, recovery, and lessons learned, with named roles and vendor responsibilities agreed in advance. In OT, IR plans must respect safety - you cannot simply power off a running process.
A structured walkthrough of an incident scenario - ransomware in the historian, a compromised operator account - where the team talks through decisions against the written plan, without touching production. It is the cheapest way to find the gaps in an IR plan before an attacker does.
The international series of standards for industrial automation and control system security, with separate parts for asset owners (62443-2), system requirements (62443-3), and component and vendor development practices (62443-4). It is the yardstick behind the phrase "industrial-grade security"; Merobix maps its platform controls to IEC 62443 as part of its security program.
IEC 62443's rating of the attacker a system is designed to resist: SL1 casual misuse, SL2 intentional attack with simple means, SL3 sophisticated attack with IACS-specific knowledge, SL4 state-level resources. The useful vendor question is which level the architecture is designed to support and against which requirements it has been assessed.
An examination in which a licensed CPA firm assesses a service organization's controls against the AICPA Trust Services Criteria and issues a detailed report - Type I at a point in time, Type II over an observation period. SOC 2 is an attestation, not a certification: you get an auditor's opinion to read, not a certificate to frame. Merobix runs a SOC 2 readiness program with SOC 2-aligned controls and evidence collection.
The international standard for information security management systems, certified by accredited bodies through stage 1 and stage 2 audits, with surveillance audits and a three-year recertification cycle. Always read the certificate's scope statement - a certification covering only a corporate office says little about the SCADA platform itself.
The NIST guide to operational technology security - the closest thing US operators have to a free, comprehensive ICS security playbook. It is guidance rather than a certifiable standard, and it cross-references IEC 62443 and the NIST CSF throughout.
A widely adopted framework organizing security programs into core functions - govern, identify, protect, detect, respond, recover. Many operators use it as the top-level structure and slot IEC 62443 and 800-82 controls underneath.
The mandatory, enforceable critical infrastructure protection standards for the North American bulk electric system, covering asset categorization, access control, monitoring, and recovery - with substantial fines for violations. Applicability depends on how your assets are categorized, not on company size alone.
The American Petroleum Institute's pipeline SCADA cybersecurity standard, whose third edition takes a profile-based approach aligned with IEC 62443. It is the reference document TSA points to and pipeline operators audit against.
Binding cybersecurity requirements issued to designated US pipeline (and rail) operators after the Colonial Pipeline incident, requiring cybersecurity implementation plans, assessments, and incident reporting. Covered operators must demonstrate segmentation, access control, and monitoring across IT and OT.
US law requiring community water systems above certain sizes to conduct risk and resilience assessments - explicitly including cyber risk to SCADA - and to maintain emergency response plans, recertified on a five-year cycle.
The FDA regulation governing electronic records and electronic signatures in regulated pharmaceutical and food contexts: secure, computer-generated audit trails, unique user attribution, and controls that make records trustworthy as evidence. It is why pharma SCADA cannot tolerate shared logins or editable histories.
A machine-readable inventory of every component and dependency inside a software product, letting operators answer "are we exposed?" within hours of a disclosure like Log4Shell. Increasingly requested in procurement and referenced in US federal guidance.
The public catalog of disclosed vulnerabilities, each with a unique identifier and severity scoring. In OT the hard part is not knowing the CVE exists but deciding how to mitigate when patching means downtime - compensating controls and network isolation carry weight that IT playbooks underestimate.
A security model that abandons the idea of a trusted internal network: every request is authenticated, authorized, and encrypted regardless of where it originates, with least privilege applied per resource. Applied to SCADA it means identity-first access and no implicit trust between zones - our zero trust for SCADA guide shows what that looks like in practice.
An authorized, scoped simulated attack by skilled testers to find exploitable weaknesses before adversaries do, delivered as a report of findings and remediations. When a vendor cites one, ask for the scope, the date, and evidence of remediation - a pen test is a snapshot, not a permanent property.
Two words vendors blur constantly. An attestation (SOC 2) is an auditor's written opinion in a report; a certification (ISO 27001, IEC 62443 schemes like ISASecure) is a pass/fail assessment by an accredited body yielding a certificate; a readiness program is preparation for either - valuable, but not yet independent assurance. The full comparison lives in our SCADA certifications guide.
| Attribute | Attestation (SOC 2) | Certification (ISO 27001, IEC 62443) | Readiness Program |
|---|---|---|---|
| Who assesses | Licensed CPA firm | Accredited certification body | The vendor itself, often with consultants |
| What you receive | Detailed report with auditor's opinion, control descriptions, and exceptions | Certificate with a defined scope statement | Internal gap assessments and evidence, no independent output |
| Validity | Covers a point in time (Type I) or observation period (Type II); renewed annually | Three-year cycle with surveillance audits | Ongoing, self-declared |
| What it proves | Controls were suitably designed and (Type II) operated effectively | The management system meets the standard within the stated scope | Intent and progress - not independent assurance |
| Buyer verification step | Read the report: opinion, exceptions, complementary user entity controls | Check certificate scope and the issuing body's accreditation | Ask for the target date and which controls are already operating |
Key takeaway: vocabulary is leverage. Every term in this glossary corresponds to something you can demand evidence for - a report to read, a certificate scope to check, a control to see demonstrated live. Vendors who welcome those questions have done the work; vendors who answer with adjectives have not. See how Merobix implements these controls on the security page, or put the questions to us directly in a guided demo.
Row-level security (RLS) is a database enforcement mechanism that filters every query so a session can only touch rows belonging to its own tenant, enforced by the database engine itself rather than by application code. In multi-tenant cloud SCADA, RLS provides a second, independent layer of tenant isolation: even if an application-level authorization bug slips through, the database still refuses to return another customer's data. Merobix applies PostgreSQL row-level security to customer-owned records alongside tenant-aware application authorization.
A replay attack is when an attacker captures legitimate telemetry or command traffic and retransmits it later so the system accepts stale data or repeats an old action - for example, replaying a normal tank-level reading to mask an overflow in progress. Defenses combine sequence numbers, timestamps, and unique sample identifiers inside cryptographically signed message envelopes, so the receiving platform can detect and reject messages it has already seen or that arrive outside an acceptable time window.
SOC 2 is an attestation, not a certification: a licensed CPA firm examines a service organization's controls against the AICPA Trust Services Criteria and issues a detailed report containing the auditor's opinion. ISO 27001 is a certification: an accredited certification body audits an organization's information security management system and issues a certificate valid for three years, with surveillance audits in between. SOC 2 dominates in North America and gives buyers a richer report to read; ISO 27001 is more widely recognized internationally. Many cloud vendors pursue both, and neither one alone addresses OT-specific requirements the way IEC 62443 does.
An outbound-only gateway is an edge device inside the OT network that initiates every connection outward to the cloud platform over TLS, so the site firewall can be configured to deny all inbound traffic permanently. Because nothing listens for inbound connections, there are no open ports for internet scanners to find, which removes the most common ICS attack vector. The Merobix gateway works on this model: it polls PLCs and RTUs locally and pushes encrypted data outbound with zero inbound firewall rules required.
RBAC, MFA, row-level security, signed telemetry, outbound-only connectivity - every term in this glossary maps to a control you can watch working in a guided walkthrough of the Merobix platform.