Glossary

Distributed Control System

A Distributed Control System is an industrial automation system that uses networked controllers to monitor and control processes.

Data Integration, Security and Trust IEC 62443 Industrial Cybersecurity for Manufacturing and OT Cybersecurity and Defense Compliance

A Distributed Control System (DCS) is an industrial automation architecture in which process measurement, control, and supervisory functions are performed by multiple networked controllers distributed across a plant or facility. It is commonly used in continuous or batch process industries such as chemicals, oil and gas, power generation, and pharmaceuticals.

In a DCS, field devices (such as sensors and actuators) connect to input/output (I/O) modules that are associated with controllers. These controllers execute control strategies, such as PID loops, logic sequences, and interlocks, according to configuration data stored in the system. The controllers communicate over an industrial network with operator stations and engineering workstations.

Typical components of a DCS include:

Field instruments and actuators
Remote or local I/O modules
Process controllers
Operator consoles and human–machine interfaces (HMIs)
Engineering and configuration stations
History, alarm, and event servers
Industrial communication networks

Operationally, a DCS provides centralized monitoring and supervisory capabilities while distributing real-time control execution close to the process. It is often referenced in standards and models such as ISA‑95, where it typically falls within the control and operations levels of an industrial automation hierarchy.

In industrial and regulated environments, security controls are commonly grouped into four categories: physical, technical (logical), administrative (procedural), and compensating controls. Each category addresses different threat vectors and has distinct validation, maintenance, and integration implications in brownfield plants.

How do I map IEC 62443 controls to ISO 27001 Annex A?

IEC 62443 and ISO 27001 Annex A align conceptually, but there is no single authoritative one-to-one mapping. You can build a usable crosswalk by scoping OT vs IT, choosing a reference mapping, mapping at the requirement level (not just clause titles), and validating against your own asset inventory, risk assessments, and control ownership. Expect gaps, overlaps, and site-specific tailoring.

How do I know whether to use the Low, Moderate, or High baseline?

Choosing Low, Moderate, or High baselines usually means applying a risk-based standard (for example, NIST 800-53 / 800-82 or IEC 62443 profiles) to your specific systems and data. In regulated, brownfield plants, the right choice depends on impact to safety, product quality, regulated data, and operations, and must be documented, justified, and kept consistent across systems.

Can a single control appear to affect multiple control families?

Yes. A single control (for example, a technical safeguard or a procedural requirement) can legitimately map to multiple control families, especially in cybersecurity and quality frameworks. This overlap is normal but must be handled with clear scoping, traceable mappings, and documented ownership to avoid double-counting, gaps, or confusion during audits.

Related Glossary

industrial control system

An industrial control system (ICS) is the set of hardware, software, and networks used to monitor and control industrial processes and equipment.

NIST SP 800-82

NIST SP 800-82 is a NIST special publication that provides guidance on securing industrial control systems, including OT in manufacturing.