← Cyberwarfare: From Statecraft to Operations

Entering the Cyber Battlespace

Digital Systems as Mission Terrain Evidence, Threat Intelligence, and Incident Response Authorization, Ethics, and Safe Practice What Cyberwarfare Is—and Is Not Cyberspace as an Operational Environment

The Road to Persistent Cyber Conflict

Estonia, Georgia, Stuxnet, and the First Shock Ukraine, 2015–2026: Campaigning Under Fire

Actors, Proxies, and Strategic Behavior

The State Cyber Ecosystem Strategic Cultures Without Stereotypes

Law, Authority, and Civilian Protection

Below Armed Conflict: Sovereignty, Intervention, Force, and Responsibility Armed Conflict: IHL and Cyber Effects

Intelligence, Indications, and Attribution

Intelligence Support to Cyber Operations Attribution Under Deception

Campaign Design and Command

From Policy Aim to Cyber Campaign Command, Authorities, and Deconfliction

Target Systems, Access, and Operational Security

Target-System Analysis and Cyber Key Terrain Access Stewardship, Capability Fit, and OPSEC

Effects Engineering and Campaign Assessment

Designing and Bounding Cyber Effects Measuring What the Campaign Changed

Critical Infrastructure and Cross-Domain Operations

Operational Technology, Safety, and Restoration Space, Telecommunications, and Multi-Domain Integration

Influence, Perception, and Public Truth

Cyber-Enabled Influence Operations Defending Truth, Trust, and Decision Space

Daily Defence in Competition and War

Mission Assurance and the Wartime Operations Floor Continuity, Recovery, and Collective Defence

Deterrence, Emerging Change, and the Final Campaign

Deterrence, Norms, and Collective Response The 2026 Horizon: AI, Supply Chains, Edge, and Identity Capstone: Build, Challenge, and Defend a Cyber Campaign

Critical Infrastructure and Cross-Domain Operations

Operational Technology, Safety, and Restoration

Understand how industrial processes, control, safety, engineering, and human operators determine physical consequence.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

Build a process-centric OT risk and effects model including safety and manual restoration.

Operational Technology, Safety, and Restoration

This lesson uses the Ukrainian grid cases to teach process-aware analysis and resilience without giving attack procedures.

Model process, control, safety, and enterprise together

Operational technology in cyberwarfare must be understood first as machinery controlling a physical process. Map process state, acceptable operating envelope, sensors, actuators, controllers, supervisory systems, engineering workstations, safety instrumented systems, historians, remote access, enterprise dependencies, vendors, and operators. Availability, integrity, and timing may matter more than data secrecy.

Separate basic process control from independent safety protection. Identify fail-safe and fail-danger states, physical inertia, alarm handling, maintenance, and local manual control. A cyber effect may alter visibility without altering process, alter control without defeating safety, or disrupt enterprise services that operators need for restoration. Each has different consequence.

The 2015 Ukraine grid incident combined enterprise access, operator-session abuse, control action, denial of control, destructive components, and communications disruption. Manual switching enabled restoration. The reusable lesson is the full operational sequence and defender recovery—not a single malware name.

OT process and safety layers — Enterprise, supervision, control, physical process, safety, and human operation form one system.

Plan for safe degradation and restoration

Defenders should prioritize known assets and communication paths, separate enterprise and control zones, constrain remote access, monitor engineering change, protect safety systems, maintain offline configurations, rehearse manual operation, and preserve out-of-band communications. CISA’s Cross-Sector Cybersecurity Performance Goals provide a risk-reduction baseline; sector engineering and safety requirements go further.

During conflict, restoration becomes operational. Define minimum safe service, load shedding, staffing, spares, vendor access, clean-room recovery, and decision authority. Coordinate cyber, engineering, safety, physical security, communications, and public messaging. Preserve evidence without delaying action needed to protect life.

Effects planners must model the same recovery paths. An operation whose advantage depends on duration will fail if manual alternatives are ready. Attempts to suppress restoration expand civilian risk and require renewed legal and command review.

OT resilience bow-tie — Preventive controls reduce compromise while safety and restoration controls contain consequence.

Resources

CISA Russian State-Sponsored Threats to Critical Infrastructure — Official synthesis of the 2015 and 2016 Ukrainian electric-sector operations and defensive implications.
CISA Cross-Sector Cybersecurity Performance Goals — Prioritized baseline practices for IT and OT risk reduction and national resilience.

← Previous: Measuring What the Campaign Changed Next: Space, Telecommunications, and Multi-Domain Integration →