Packages / Critical Infrastructure And OT
Critical Infrastructure And OT
Operational technology, SCADA, critical assets, resilience, and infrastructure operations.
- Patterns
- 59
- As primary component
- 46
Patterns in this package
Generator performance standards (agreed schedule 5.2 standards under S5.2.5.x at the automatic, minimum or negotiated access standard) and the power system model data behind them (NER S5.2.4(b): functional block diagrams, parameters with settings, gains, time constants, delays and deadbands, encrypted models, model source code, releasable user guides, Power System Design and Setting Data Sheets) for a named generating system. The NER treats this as confidential information (cl 3.13.3(k)-(l), 5.3.4 model data, 8.6.1) and AEMO releases model source code only in compiled or encrypted form.
Issuing-body records about Aviation Security Identification Card (ASIC) and Maritime Security Identification Card (MSIC) holders and applicants: the Register of ASICs (Aviation Transport Security Regulations 2005 reg 6.23) and Register of MSICs (Maritime Transport and Offshore Facilities Security Regulations 2003 reg 6.08T), which hold the holder's name, residential address, card colour/type, the unique number of the card, issue, expiry and cancellation dates and operational need, plus AusCheck background check outcomes and cancellation notices. The card number format is not public (issuer-specific, Secretary-approved), so the card number is matched only by its label.
Identifies substantive critical-infrastructure and essential-service network or control-system designs. Topic phrases are retained for discovery; enforcement requires segmentation, data-flow, trust-boundary, VLAN, DMZ, firewall, or OT-zone design content, and high confidence also requires a populated address, VLAN, port, device, or rule detail.
Detects Australian OTC electricity derivative and power purchase agreement confirmation content - documentation under the June 2006 Australian Electricity Addendum and 2005 ISDA Commodity Definitions, electricity swap/cap/floor/swaption confirmations settled against the AEMO regional reference price, and PPA confirmation phrasing with $/MWh fixed prices.
Detects Australian electricity forward/broker curve exports - forward or broker curve phrasing tied to NEM regional reference identifiers (QLD1, NSW1, VIC1, SA1, TAS1), load shape terms (flat/peak/off-peak), or calendar/quarter strip notation (Cal27, Q1-27, CY2027, FY27) with $/MWh values. Internal curve marks reveal a participant's price expectations and valuation basis.
Completed high-voltage switching sheets (switching programs) and Access / Test Permits for electrical apparatus, in the form used by Queensland electricity entities under the Queensland Electricity Entity Standard for Safe Access to High Voltage Electrical Apparatus (SAHVEA, Nov 2023). SAHVEA cl 7.3 requires a switching sheet to carry a unique reference number, the apparatus, step-by-step switching to isolate, prove de-energised and earth, the completion time of each step, isolation points and DNOBs, Operator Earth locations, and the issue, surrender and cancellation of permits. SAHVEA cl 9.2 requires an Access / Test Permit to carry the associated Switching Sheet number, Work Area, issue and surrender times, the Switching Co-ordinator, Nearby Exposed Live HV/LV and an Abnormalities Section. Populated sheets expose isolation points, equipment identifiers, network configuration and work schedules. SAHVEA itself, ENA DOC 003, blank forms and training material are decoys. "Sanction for test" and "vicinity authority" are not SAHVEA terms and are not used as anchors.
Detects Australian mining technical records - JORC Code resource and reserve estimates (Measured/Indicated/Inferred resources, Proved/Probable reserves, Competent Person statements), drill-and-blast design parameters (blast patterns, powder factor, maximum instantaneous charge, stemming), pit geotechnical stability assessments, and spelled-out mining tenement grants.
Detects AEMO MSATS retail-market transaction content - aseXML transaction names (CATSChangeRequest, NMIDiscoveryRequest/Response, ServiceOrderRequest/Response, MeterDataNotification), CATS change-request codes (e.g. CR1000/CR1060, CR4050/1, CR5050/1), and role-coded NMI standing data (FRMP/LNSP/MDP with an NMI). These artefacts carry customer transfer, metering and consumption context regulated under the retail market procedures.
Detects AEMO NEM dispatch bid/offer submission artefacts - the MMS bidding table vocabulary (BIDDAYOFFER, BIDOFFERPERIOD, BIDOFFERFILETRK, MNSP day-offer tables), the Dispatch Bid/Offer Submissions JSON payload fields (energyBids, fcasBids, mnspBids, rebidExplanation), and the participant FTP bid filename convention (<PARTICIPANTID>_<x>BID<x>_<timestamp>.zip/.json). Pre-dispatch bids, price bands and rebid reasoning are commercially critical trading data for market participants.
Detects AEMO Dispatchable Unit Identifiers (DUIDs) when labelled as such. DUIDs are short (max 8 character) unit codes - modern IDs are alphanumeric, legacy IDs may contain '#', '/' or '-' (e.g. BARRON-1, W/HOE#1, ER01, LOYYB1). IMPORTANT: DUIDs are fully PUBLIC identifiers (published in the AEMO NEM Registration and Exemption List and in five-minute NEMWEB dispatch data). This pattern is a discovery-only context marker and corroborative building block for sensitive-content patterns (bids, availability, curves) - it must never enforce on its own. A bare DUID token is indistinguishable from ordinary text, so the pattern requires the DUID label (or dispatchable-unit phrasing) immediately before the code.
Completed system restart material for a named National Electricity Market generating system or network: local black system procedures (LBSPs) that generators, integrated resource providers and network service providers must prepare and submit to AEMO for approval under NER cl 4.8.12(d)-(g), and extracts of the AEMO system restart plan, which NER cl 4.8.12(b) makes confidential information. Such a record holds plant and unit data, units that can restart without external supply, dead-bus synchronisation and trip-to-house-load (TTHL) capability, minimum load and transformer energisation limits, step-by-step restart switching, and approver and contact blocks. The blank AEMO Generator LBSP template, the SRAS Guideline, the System Restart Standard and news about restart tests contain the same headings without values, so they stay at 65 discovery.
Identifies Queensland building approvals, permits, certifications, development applications and decision notices. Topic phrases are retained for discovery; enforcement requires populated approval-record fields (applicant, property, certifier, decision date, application number), and high confidence adds a second field plus decision or authority context.
Completed notifications and internal records of a serious electrical incident or dangerous electrical event under the Electrical Safety Act 2002 (Qld). Serious electrical incident (s 11) covers a person killed by electricity or receiving a shock or injury treated by or under a doctor, or at high voltage. Dangerous electrical event (s 12) covers unsafe proximity to HV equipment, significant property damage caused by electricity, and unlicensed or unsafe electrical work. A business or undertaking must notify the regulator immediately (Electrical Safety Regulation 2013 s 265, with written notice within 48 hours if required and records kept 5 years). A distribution entity must give written notice in the approved form received within 24 hours (s 266). Section numbers are taken from the 27 Sep 2024 version of the Regulation; the current version could not be retrieved. Records name the injured or involved person, date, time and location, the equipment and voltage, the injury and treatment, and the notification to the Electrical Safety Office. The Act and Regulation, ESO safety alerts and prosecution summaries, toolbox talks and blank forms are decoys.
Queensland major hazard facility (MHF) safety case outlines and safety cases under the Work Health and Safety Regulation 2011 (Qld) chapter 9 (ss 551-561, Schedule 18: facility description, process flow drawings, general layout drawings locating major incident hazards and initiators, security arrangements), and manifests of hazardous chemicals under s 347 and Schedule 12 (UN number, proper shipping name, class and division, container and storage area identification, after-hours contacts). Populated versions give a hostile reader a map of what is stored where and how the site is protected.
Unredacted working copies of Queensland referable dam emergency action plans (EAPs) under the Water Supply (Safety and Reliability) Act 2008 s 352H, and failure impact assessments, that contain the warning and notification lists (named individuals with mobile numbers, in order of priority) or property-level population at risk (PAR) detail (street addresses with occupant or PAR counts). Approved EAPs are published by design on the s 352M register with individuals' names, addresses and contact details removed, so the published plan is not the target; the personal detail stripped from it is.
Security plans and safety and security management systems for security sensitive ammonium nitrate (SSAN) and other explosives held under a prescribed authority in Queensland (Explosives Regulation 2017 (Qld) s 8A, ss 46A-46D, Schedule 3): identified security risks, access detection, chain of possession, authorised receivers, the list of persons allowed unsupervised access, magazine and store identifiers, and reviews after a change in the national counter terrorism alert level or a loss of explosives.
Identifies SOCI Act, critical infrastructure resilience and AESCSF compliance or maturity assessments that record an entity's own results. Assessment titles alone are discovery-only; enforcement requires AESCSF practice IDs, maturity indicator levels or security profiles, or populated compliance status rows. CIRMP records and reports are handled by au-soci-risk-management-program-record.
Completed regulatory cyber incident reports made to the Australian Signals Directorate: mandatory cyber security incident reports under the Security of Critical Infrastructure Act 2018 (s 30BC critical incidents, 12 hours, written record within 84 hours of an oral report; s 30BD other incidents, 72 hours, written record within 48 hours), content entered in the ASD/ACSC "Report a cyber security incident" form (organisation, ABN, contact number, date and time the incident was identified, whether it is ongoing, incident type, Home Affairs consent), and ransomware payment reports under s 27 of the Cyber Security Act 2024. Distinct from global-security-incident-report and the OT cyber incident report classifiers, which cover internal incident and forensic reports; this one requires the regulatory reporting frame plus populated ASD form fields.
Documents that are "relevant information" under s 5A of the Security of Critical Infrastructure Act 2018 (Cth): a critical infrastructure risk management program (CIRMP, s 30AC) and the annual CIRMP report (s 30AG: up-to-date statement for a financial year, board or governing body approval, hazards with a significant relevant impact; LIN 23/006 and LIN 26/075 terms), Register of Critical Infrastructure Assets submissions (s 6 interest and control information, s 7 operational information), and Systems of National Significance enhanced cyber security obligation documents (incident response plan s 30CD, cyber security exercise evaluation reports s 30CQ / 30CR, vulnerability assessment report s 30CZ, system information reporting notices s 30DB / 30DC). There is no statutory marking for this material, so the classifier does not anchor on "PROTECTED" or any other label.
Integrated Public Number Database (IPND) data exchanged between carriage service providers, Data Providers, Data Users and the IPND Manager (Telstra): fixed-width upload and download files (HDR header record with an IPND file type, 905-character customer records, TRL trailer record), IPND file names (IPNDUP upload, IPNDES/LA/DI/LD/RS/EW download) and IPND extracts or reject reports listing public numbers with their List Code. List Code UL (Unlisted Number) and SA (Suppressed Address) records are protected by Telecommunications Act 1997 Part 13 (s 276 disclosure offence; s 285 permitted IPND uses exclude unlisted numbers). "Silent number" is an informal synonym for an unlisted number, not IPND terminology, and is used only as weak corroboration.
Records that carriers and carriage service providers must make of disclosures of protected information (Telecommunications Act 1997 (Cth) Part 13, s 276 primary offence) to law enforcement and enforcement agencies: the s 306 record (made within 5 days of the disclosure and kept for 3 years) and the s 306A record for prospective authorisations. A populated record gives the name of the person who disclosed the information, the date of disclosure, the grounds (for example s 280 authorised by law, s 313 assistance), warrant or authorisation details including authorisations under ss 178, 179 or 180 of the Telecommunications (Interception and Access) Act 1979, the authorising officer and date, the requesting agency and request date, the service disclosed and the s 187AA data-set items. The same fields appear in agency authorisation / request notices received by the provider. OAIC guidance, the Acts, ACMA and TIA Act annual report statistics and blank templates are decoys. Overlaps with lawful-interception-warrant, which covers interception and stored communications warrants (TIA Act secrecy) rather than Part 13 disclosure records; a record that cites the TIA Act next to a service number may also fire that classifier.
Identifies documents containing references to scada network diagrams in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Content of an aviation industry participant's Transport Security Program (TSP, Aviation Transport Security Act 2004 s 16; disclosing TSP content without the participant's consent is an offence under Aviation Transport Security Regulations 2005 reg 2.06) and of maritime security plans, ship security plans and offshore security plans (Maritime Transport and Offshore Facilities Security Regulations 2003 regs 3.12, 4.115 and 5A.105 require them to be protected against unauthorised access, amendment and disclosure). Enforcement needs populated plan structure: named port / company / ship / offshore security officers (PSO, CSO, SSO), 24-hour security contact numbers, restricted and cleared zone or screening point tables, and executed Declarations of Security. Australian law has no "Security Sensitive Information" marking; US TSA Sensitive Security Information (49 CFR 1520) material is an explicit exclusion.
Identifies drinking-water and effluent quality monitoring records: laboratory or field results with measured parameters and units, and sample/site records. Water quality wording alone is discovery-only.
Outcome records of worker screening and background checks about an identified person: the AusCheck Critical Infrastructure Background Check Outcome (CIBCO) used for SOCI critical workers under the CIRMP Rules (LIN 23/006 s 9; enhanced requirements LIN 26/075 s 9A), with findings such as Unfavourable Criminal History, CIRMP security-relevant offence, meets / does not meet statutory criteria, Adverse or Qualified Security Assessment; NDIS / Queensland disability worker screening clearance, exclusion, interim bar or negative notice (Disability Services Act 2006 (Qld)); national police check / criminal history check results; and security clearance outcomes at the PSPF Policy 12 levels (Baseline, NV1, NV2, PV). Screening reference, clearance and application numbers have no public format and are matched only by label. Bare reference numbers are covered by au-police-check-reference; clearance mentions without an outcome record by global-security-clearance-reference.
Detects CircleCI personal access tokens (CCIPAT_ prefix). These tokens authenticate to the CircleCI API and can read/modify pipelines, contexts and project settings; a leak enables CI/CD compromise.
Detects GitLab personal access tokens (glpat- prefix). A leaked PAT grants repository, CI/CD pipeline and package-registry access scoped to the issuing user.
Detects GitLab pipeline trigger tokens (glptt- prefix). These tokens let external systems start CI/CD pipelines via the trigger API; a leak allows unauthorized pipeline execution.
Detects GitLab runner authentication tokens (glrt- prefix). These tokens authenticate a CI/CD runner to a GitLab instance; a leak lets an attacker impersonate a runner and capture job payloads.
IEC 61850 System Configuration Language (SCL) files for a configured substation or IED: SCD, ICD, CID, SSD and IID exports from substation configurator tools. Detects the SCL XML namespace and the populated Communication section (ConnectedAP with IP addressing, GOOSE and Sampled Values multicast MAC addresses in the 01-0C-CD range, APPIDs) plus IED, logical device and control-block structure. A populated SCD/CID gives the station bus network plan, IED names and GOOSE trip-signal addressing for a live substation.
Detects National Metering Identifier (NMI) patterns used in the Australian energy market. A 10 or 11 digit number identifying electricity and gas connection points. Also covers the gas Meter Installation Registration Number (MIRN), which is allocated in the NMI number space: AEMO reserves the 5 XXX XXX XXX range for the gas industry (NSW/ACT 52, Vic 53, Qld 54, SA 55, WA 56, Tas 57) and MIRNs travel in the same aseXML NMI element with a checksum attribute. Context-dependent: requires energy/meter keywords.
Identifies substantive internal network-infrastructure design and topology documents. Topic phrases are retained for discovery; enforcement requires segmentation, trust-boundary, routing, VLAN, DMZ, data-flow, or firewall-design content, and high confidence also requires a populated address, VLAN, port, device, or rule detail.
Identifies substantive operational-technology, SCADA, ICS, and industrial-control security assessments. Topic phrases are retained for discovery; enforcement requires findings, affected assets, evidence, remediation, attack paths, firmware, segmentation, credential, or remote-access weaknesses, and high confidence additionally requires a concrete technical indicator and severe exploit consequence.
Machine-format PLC program and project exports: Rockwell Studio 5000 / RSLogix 5000 L5X (RSLogix5000Content XML) and L5K (IE_VER text) files, Siemens TIA Portal Openness block XML (Document / Engineering version / SW.Blocks), and Schneider Control Expert / Unity Pro XEF exchange files (FEFExchangeFile). A populated export carries the controller model, network addresses, I/O modules, tags and control logic of a production control system.
Identifies substantive SCADA and industrial-control-system documentation, including SCADA/ICS/OT network diagrams and topologies. Topic phrases are retained for discovery; enforcement requires point, tag, I/O, alarm, HMI, RTU, protocol-map, polling, or control-logic configuration content, or OT network-diagram structure (IP schema / addressing tables, PLC/RTU lists, Purdue levels, zones and conduits, control zones, trust boundaries, field networks), and high confidence also requires a populated asset, node, address, subnet, VLAN, register, or outstation detail.
SCADA and telemetry point lists and register maps for a live system: Modbus register maps (rows pairing an address with a holding register, input register, coil or discrete input type, plus function codes), DNP3 Device Profile XML data-point lists (binaryInputPoints / analogInputPoints with populated index and name), and OPC UA NodeId lists (ns=n;i= / s= / g= / b= identifiers). Enforcement requires repetition of the row or point structure so tutorials and specifications that show one or two examples do not fire.
SIM / USIM personalisation and key files exchanged between SIM vendors, mobile network operators and HSS/AuC provisioning: a header row naming subscriber key columns (Ki, OPc, ADM1, KIC1/KID1/KIK1, EKI) next to ICCID or IMSI, followed by populated rows that pair an ICCID (ITU-T E.118, MII 89, e.g. Australian issuer prefixes 8961 and 8967210 on the ACMA register) and an IMSI (3GPP TS 23.003, MCC + MNC + MSIN, at most 15 digits; Australia MCC 505) with 128-bit key values (32 hex characters, per 3GPP TS 35.206 K and OPc). The file layout is vendor-proprietary; the pySim card-key CSV and pysim-perso column sets are used only as shapes. Excludes the published 3GPP TS 35.208 test-set values, "Test Set" / "35.208" text, test networks (MCC 001) and pySim / Open5GS tutorial or documentation text.
Plant-specific process safety engineering records: HAZOP (hazard and operability) study worksheets with node / guide word / deviation / causes / consequences / safeguards / recommendations columns, and safety instrumented system (SIS) cause and effect matrices and safety requirements with trip tags, voting (1oo2, 2oo3) and SIL ratings. Populated worksheets and matrices tie instrument tags and trip logic to a real facility, which is why enforcement needs populated tags and structure, not the methodology vocabulary that appears in standards, training and textbooks.
Identifies CI/CD pipeline configuration files (GitHub Actions workflows, GitLab CI, Azure Pipelines, Jenkinsfiles, Bitbucket/CodeBuild/CircleCI configs) containing pipeline syntax, secret references or internal build/registry hosts. Pipeline topic wording alone is discovery-only.
Detects printed or prose PLC logic programs and program listings: ladder or rung listings with instruction text such as XIC(...)OTE(...), structured-text logic, program/routine/controller names and controller tags. Complements global-plc-project-export, which covers native L5X/L5K/TIA Openness/XEF export files; this pattern does not use those export-file anchors. Topic wording alone is discovery-only.
Detects distributed control system configuration records: DCS configuration/database/tag-list wording with instrument tags and populated setpoints, alarm limits, controller nodes, card/channel assignments and IP addresses. Topic wording alone is discovery-only.
Identifies substantive substation protection-relay settings and coordination records. Topic phrases are retained for discovery; enforcement requires a populated current, voltage, impedance, timing, or zone value, and high confidence also requires a substation, feeder, breaker, relay model, or device ID.
Identifies substantive pipeline pressure, flow, operating-limit, and control-setpoint records. Topic phrases are retained for discovery; enforcement requires a populated pressure or flow value, and high confidence also requires a pipeline segment, station, valve, control tag, or other live asset reference.
Identifies substantive water-treatment dosing formulas and control values. Topic phrases are retained for discovery; enforcement requires a populated dose, concentration, feed rate, or process value, and high confidence also requires a treatment-plant asset, process, or control-tag reference.
Identifies substantive electric-grid generation dispatch, unit-commitment, and power-system dispatch plans. Topic phrases are retained for discovery; enforcement requires populated generation, reserve, energy, or reactive-power quantities, and high confidence also requires current interval, generating unit, constraint, interconnector, or grid-operator detail.
Identifies substantive industrial plant shutdown, startup, emergency-shutdown, and turnaround procedures. Topic phrases are retained for discovery; enforcement requires ordered isolation, depressurisation, purge, valve, pump, permissive, interlock, handback, or verification actions, and high confidence also requires a populated equipment identifier, operating value, or timing.
Identifies substantive refinery process-control setpoint and operating-envelope records. Topic phrases are retained for discovery; enforcement requires an actual process value, and high confidence also requires a control-loop tag or named refinery process asset.
Detects rail signalling configuration data: interlocking or control-table wording with populated signal, route, points, track-circuit and balise identifiers plus overlap, release-timing, speed and chainage values. Topic wording alone is discovery-only.
Detects air traffic operational procedures: ATC unit, local operating or separation procedure wording with populated sector, frequency, waypoint, transfer-level and restriction fields and operational values (flight levels, runways, frequencies, distances). Topic wording alone is discovery-only.
Identifies substantive port-facility security and access manifests. Topic phrases are retained for discovery; enforcement requires vessel, port-call, berth, cargo, crew, visitor, escort, access-zone, gate, or security-level manifest content, and high confidence also requires a populated IMO, port-call, manifest, berth, zone, or ISPS security-level identifier.
Detects telecom core network configurations: mobile/IMS/EPC/5GC configuration wording with populated PLMN, APN, Diameter realm/peer, point-code and peer-address values, 3GPP realm FQDNs and core node names. Topic wording alone is discovery-only.
Identifies substantive emergency and critical-service restoration prioritisation plans. Topic phrases are retained for discovery; enforcement requires ranked assets/services, restoration sequence, dependencies, alternate supply, crew assignment, affected sites, service areas, or estimated restoration content, and high confidence also requires a populated priority, asset/site identifier, time, capacity, or customer-impact value.
Identifies substantive critical and maintenance spare-parts inventories. Topic phrases are retained for discovery; enforcement requires part-number, stock-on-hand, reorder, lead-time, storage, compatible-asset, supplier, or minimum-stock fields, and high confidence also requires a populated part, quantity, reorder, warehouse, bin, or location value.
Identifies substantive operational-technology, ICS, SCADA, and industrial-control cyber incident reports. Topic phrases are retained for discovery; enforcement requires case facts such as affected assets, timelines, initial access, containment, indicators, root cause, recovery, or operational impact, and high confidence also requires a concrete indicator, vulnerability, address, or control asset identifier.
Identifies substantive physical badge and door access-control maps. Topic phrases are retained for discovery; enforcement requires floor-plan, reader-to-door, security-zone, access-level, restricted-area, entry-point, zone-boundary, or credential-group relationships, and high confidence also requires populated door, reader, zone, entry, credential-group, or access-level identifiers.
Detects CCTV coverage and blind-spot analyses: CCTV survey or blind-spot wording with populated camera records (IDs, NVR channels, locations, FOV) and located coverage weaknesses. Topic wording alone is discovery-only.
Identifies substantive hazardous-material, dangerous-goods, and chemical storage maps. Topic phrases are retained for discovery; enforcement requires storage-area, containment-zone, chemical-name, dangerous-goods-class, segregation, spill-containment, or emergency-isolation relationships, and high confidence also requires a populated UN number, tank/store/cabinet/area identifier, or quantity.
Detects dam safety and integrity engineering reports: dam safety review, surveillance or inspection report wording with instrumentation readings (piezometers, seepage weirs, survey marks, reservoir levels) and located condition findings (seepage, cracking, erosion at the toe, spillway or abutment). Distinct from the referable-dam emergency action plan classifier, which covers EAP notification and inundation content. Topic wording alone is discovery-only.
Populated staff work rosters and shift schedules (duty rosters, on-call rosters, nursing and custodial post rosters, control room shift patterns), detected from the roster's own structure: repeated shift time ranges, a day or date column header over rows of shift codes (D, N, E, L, AM, PM, RDO, OFF, OT, OC, AL, on call, leave), and site or role context. Staff names are NOT required, because a roster with names removed still shows when a site is staffed or thinly staffed and where a particular line or post will be.