303 Overwatch A.S.B.L logo#spacecollectivedefense

Reference · Technology taxonomy

Technologies at critical infrastructure sites

As of 

The kinds of technology found at the sites on the critical infrastructure map, how they connect, and the services each kind of site provides, written for the people who run and secure those sites. Types, not products: nothing here names a site, an operator or a vendor, and every term is framed by the standard or law that defines it.

Legilux

Published by 303 Overwatch A.S.B.L from the standards and legal acts it cites, so that an operator can name the systems its NIS2 risk measures, and the exercises that test them, have to cover. Accredited by the Luxembourg Ministry of National Education.

TEN 1.0

Every definition is quoted from or framed by one of the 128 standards and sources listed below, and every type is classed in the METEORSTORM Data Model (TEN Reference Workbook 1.0, revised ). Taxonomy version 0.1: 100 technology types and 53 services, reviewed on by 303 Overwatch.

Common to every site

PCE-TESEG-GR

The operational technology every one of these sites runs: the controllers, supervisory systems, networks and time sources that the sector-specific technologies sit on.

Technologies, by Purdue level

Level 4, enterprise

SVC-DPAST-SW

Enterprise IT systems (Level 4)

Business systems such as enterprise resource planning, asset and maintenance management, and business planning and logistics. ISA describes Level 4 as “Business planning and logistics” which “Describes all the activities related to running a business. It includes enterprise resource planning (ERP) systems.” (ISA-95 standard page). IEC 62264-1 defines the interface between this enterprise domain and manufacturing operations at Level 3.

Communicates with
Process data historian
Sources
IEC 62264-1; ANSI/ISA-95; NIST SP 800-82r3

Level 3, site operations

SVC-HYAST-SW

Process data historian

A data historian is “A centralized database that supports data analysis using statistical process control techniques.” (NIST SP 800-82r3, Appendix B). It records time-stamped process values and events from the control system, and NIST notes it can serve as a supplemental source of event data in incident response (Appendix E).

Sources
NIST SP 800-82r3

SVC-CPAST-HY

Remote access gateway

The VPN concentrator, jump server or brokered-access appliance through which staff or vendors reach the OT environment from outside it. NIST defines remote access as “Access to an organizational system by a user (or a process acting on behalf of a user) communicating through an external network.” (NIST SP 800-82r3, Appendix B) and advises that it “should not circumvent or negate safety or security controls” (section 6.2.10).

Sources
NIST SP 800-82r3; IEC 62443-3-3

Level 2, supervisory control

SVC-CPAST-HY

Distributed control system (DCS)

“In a control system, refers to control achieved by intelligence that is distributed about the process to be controlled, rather than by a centrally located single unit.” (NIST SP 800-82r3, Appendix B). Its supervisory functions, operator stations and engineering stations are usually confined to a single site (NIST SP 800-82r3, section 2.3.3).

Sources
NIST SP 800-82r3; IEC 62264-1

SVC-CPAST-HY

SCADA server / master station

SCADA is “A generic name for a computerized system that is capable of gathering and processing data and applying operational controls over long distances.” The SCADA server is “The device that acts as the master in a SCADA system.” (both NIST SP 800-82r3, Appendix B). NIST also calls it a control server, MTU or supervisory controller (Appendix B, “control server”).

Sources
NIST SP 800-82r3; IEC 62264-1; ANSI/ISA-95

SVC-CPAST-HY

Human-machine interface (HMI)

“The hardware or software through which an operator interacts with a controller. An HMI can range from a physical control panel with buttons and indicator lights to an industrial PC with a color graphics display running dedicated HMI software.” (NIST SP 800-82r3, Appendix B).

Sources
NIST SP 800-82r3

SVC-CPAST-HY

Engineering workstation

A workstation is “A computer used for tasks such as programming, engineering, and design.” (NIST SP 800-82r3, Appendix B). In OT it holds the programming interface used to configure and change controller logic and settings (NIST SP 800-82r3, section 2.3.4).

Sources
NIST SP 800-82r3; IEC 61131-3

Level 1, basic control

SVC-CPAST-HY

Programmable logic controller (PLC)

“A solid-state control system that has a user-programmable memory for storing instructions for the purpose of implementing specific functions such as I/O control, logic, timing, counting, three mode (PID) control, communication, arithmetic, and data and file processing.” (NIST SP 800-82r3, Appendix B). Its control logic is written in the languages set out in IEC 61131-3, such as structured text, ladder diagram and function block diagram.

Sources
NIST SP 800-82r3; IEC 61131-3; IEC 62443-4-2

SVC-CPAST-HY

Remote terminal unit (RTU)

“A computer with radio interfacing used in remote situations where communications via wire is unavailable. Usually used to communicate with remote field equipment. PLCs with radio communication capabilities are also used in place of RTUs.” (NIST SP 800-82r3, Appendix B). In SCADA systems it controls the local process at a field site and passes data back to the control server (NIST SP 800-82r3, section 2.3.2).

Sources
NIST SP 800-82r3

SVC-CPAST-HY

Safety instrumented system (SIS)

“A system that is composed of sensors, logic solvers, and final control elements whose purpose is to take the process to a safe state when predetermined conditions are violated.” (NIST SP 800-82r3, Appendix B, citing ANSI/ISA-84). Its specification, design, installation, operation and maintenance in the process sector are governed by IEC 61511-1, and it is usually kept independent of the basic process control system (NIST SP 800-82r3, section 2.3.7).

Sources
NIST SP 800-82r3; IEC 61511-1

Level 0, the physical process

SVC-HYAST-HY

Field devices: sensors, actuators and drives

A sensor is “A device that produces a voltage or current output that is representative of some physical property being measured (e.g., speed, temperature, flow).” An actuator is “A device for moving or controlling a mechanism or system.” (both NIST SP 800-82r3, Appendix B). In this taxonomy the category also covers valves, motors, drives and the I/O wiring or fieldbus that connects them to controllers.

Sources
NIST SP 800-82r3; IEC 62264-1; ANSI/ISA-95

Across the levels, or outside them

SVC-HYAST-HY

Industrial network and conduits

The switches, routers, firewalls and unidirectional gateways (data diodes) that join OT assets and separate them into zones. A firewall is “An inter-network gateway that restricts data communication traffic to and from one of the connected networks” and a data diode is “A network appliance or device that allows data to travel only in one direction.” (both NIST SP 800-82r3, Appendix B). IEC 62443-3-2 requires “partitioning the SUC into zones and conduits” and setting a target security level for each.

Sources
NIST SP 800-82r3; IEC 62443-3-2; IEC 62443-3-3; IEC 62443-1-1

SVC-HYAST-HY

Time and frequency distribution

Time sources, such as GNSS-disciplined reference clocks, and the distribution protocols, such as NTP and PTP, that give OT devices a common time. NIST states “Time synchronization solutions enable an organization to synchronize time across many devices.” (NIST SP 800-82r3, section 6.2.12) and names “suitable mechanisms (e.g., GPS, IEEE 1588)” (Appendix F, SC-45(1)). The clock synchronisation protocol is defined in IEEE 1588-2019, and primary reference time clocks are characterised in ITU-T G.8272.

Sources
NIST SP 800-82r3; IEEE 1588; ITU-T G.8272; NIST IR 8323r1

Standards and sources

Each was checked on its publisher’s own page. Quoted definitions are quoted exactly; where only a publisher’s abstract could be read, no clause is cited.

Reviewed 2 October 2026. Taxonomy version 0.1.

If these systems run at your site

Every kind of site on this page is in a sector NIS2 lists in Annex I; if your organisation is in scope, that brings the duty to exercise your security measures and assess their effectiveness. 303 Overwatch runs a no-fee working session that helps your team build that exercise programme around the systems at your site, and accredited SCOR training for the people who run them.

Talk to the Center of Excellence