Building and utility plant
Boilers, refrigeration, compressed air, water treatment, switchgear, building controls and fire and gas systems. A wrong action here can reach the environment and the whole site, and these are the systems most often left on the flat network.
Classes in this family
7; 0 adaptive by default, 5 whose wrong action reaches a person- Boiler and burner control safety SL-T 3 fixed
Controls the burner, the water level and the pressure of a boiler that runs the site. - Building management system business SL-T 2 fixed
Runs the heating, ventilation, air handling and room conditions of the building, including the clean and cold areas production depends on. - Compressed air and pump station line SL-T 1 fixed
Keeps the site supplied with compressed air, water or process fluid from a controller that sequences the units. - Fire and gas detection safety SL-T 3 fixed
Detects fire or gas and trips ventilation, shutdown and evacuation; a safety function for the whole building. - Refrigeration plant control line SL-T 2 fixed
Runs compressors, condensers and evaporators to hold the cold chain, often on ammonia. - Switchgear and power monitoring supervisory SL-T 2 fixed
Switches and monitors the site's electrical supply: incomers, distribution, standby generation and metering. - Water and effluent treatment control line SL-T 2 fixed
Doses chemicals and controls the flows that treat incoming water, clean the lines and discharge effluent.
Zones this family sits in
| safety | Safety zone: safety controllers, safety scanners and instrumented systems, kept on their own conduit so nothing on the process side can command them. Conduit: safety to line: a safety conduit that carries status out and accepts no command in from the process network. |
|---|---|
| business | Site business zone: the IT side of the boundary, reached from the plant only through a controlled conduit. Conduit: site business to plant: brokered through the DMZ, jump host and recorded session for anything that reaches down. |
| line | Line zone: the controllers, drives and stations of one production line, sharing a network and a supervisor. Conduit: line to plant supervisory: the line reports up and takes recipes down through a boundary device with a deny-by-default rule set. |
| supervisory | Plant supervisory zone: SCADA, historians, HMIs and engineering workstations that see and command many lines. Conduit: plant supervisory to site business: through the industrial DMZ only, no direct session from the office to a controller. |
What reaches this family
| IEC 62443 | Attaches to every automated asset the owner runs, in every zone class; the rows differ by zone, by connectivity and by behaviour. Binds Part 2-1 binds the asset owner; Part 3-2 is the owner's zoning and risk assessment; Part 3-3 is what the owner specifies for the system. Part 2-4 binds the service provider and Parts 4-1 and 4-2 the product supplier, so those rows are rendered as what to ask. |
|---|---|
| SP 800-82 | Attaches to every asset as the OT-specific overlay: architecture, remote access, patching in OT and incident response. Binds guidance addressed to the operator of the OT environment: it binds nobody in law and is what most OT security programmes are assessed against. |
| AI Act | Attaches only to an adaptive controller or a safety component that is an AI system; a fixed-program machine gets no row, and the page says why. Binds Articles 26 and 4 bind the deployer, which is the asset owner using the system; Articles 12 to 15 bind the provider; a deployer that substantially modifies the system becomes its provider. |
| Machinery Regulation | Attaches to every physical machine and safety component; a controller, a server or a read-only sensor carries no row of its own. Binds the manufacturer of the machine, and whoever substantially modifies it; the owner's row is what to demand at purchase and hold, and what it becomes liable for on a substantial modification. |
| ISO 27001 | Attaches the supplier and change controls to every asset and the network controls to every connected one. Binds the organisation that holds the certificate, through the Annex A controls it declared applicable. |
| Building and utility plant | NIST SP 800-82 adds its building automation row here: SP 800-82 SECTOR-2. |
Register the assets in this family
Paste the list; every asset in this family is placed in its class, given its zone and SL-T, its behaviour and connectivity, and carries the rows above. Eight assets free, no account.
Build my cell register