SCADA/ICS System Documentation and Network Diagrams

Identifies substantive SCADA and industrial-control-system documentation, including SCADA/ICS/OT network diagrams and topologies. Topic phrases are retained for discovery; enforcement requires point, tag, I/O, alarm, HMI, RTU, protocol-map, polling, or control-logic configuration content, or OT network-diagram structure (IP schema / addressing tables, PLC/RTU lists, Purdue levels, zones and conduits, control zones, trust boundaries, field networks), and high confidence also requires a populated asset, node, address, subnet, VLAN, register, or outstation detail.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence requires substantive control-system configuration content or OT network-diagram structure. High confidence adds a deployable asset, node, address, subnet, VLAN, protocol register, or outstation value.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth), Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

CIS Controls, ISO 27001, NIST CSF

Data categories

infrastructure, technology

Scope

narrow

Risk rating

10

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:SCADA\s+(?:system|configuration|network|architecture)\s+documentation|ICS\s+(?:system|configuration|network|architecture)\s+documentation|industrial\s+control\s+system\s+(?:documentation|configuration\s+manual)|SCADA/ICS\s+(?:documentation|architecture)|(?:SCADA|ICS|OT)\s+network\s+(?:diagram|topology)|(?:industrial\s+control|control\s+system)\s+network\s+diagram)\b

Should match

• SCADA system documentation — Low-tier probe - document topic without configuration content
• SCADA configuration documentation: tag database, I/O mapping, alarm configuration, HMI screen, and Modbus register map — Medium-tier probe - substantive configuration content without populated live values
• SCADA system documentation for production RTU node RTU-07 at 10.24.8.15: protocol register map contains Modbus register 40017, and the tag database maps PUMP_RUN to HMI node HMI-02 — High-tier probe - configuration content with populated asset, address, register, tag, and node details
• OT network topology — Low-tier probe - network-diagram topic without diagram structure (merged from global-top500-441-scada-network-diagrams)
• ICS network diagram (rev C): zones and conduits between the Purdue level 3 operations zone and the level 1 field network; DMZ trust boundary at the historian — Medium-tier probe - OT diagram structure (zones and conduits, Purdue levels, trust boundary) without populated addresses
• SCADA network diagram - North Plant water treatment, rev 7 Purdue level 2 supervisory zone / level 1 control zone, zones and conduits per site standard IP addressing table: VLAN 120 OT-CONTROL 10.24.8.0/24 VLAN 130 OT-FIELD 10.24.9.0/24 PLC list: PLC-11 10.24.9.21 (filter gallery), PLC-12 10.24.9.22 (clear water pumps) RTU list: RTU-07 10.24.9.40 (reservoir outstation, DNP3 outstation 7) Conduit C-04: HMI-02 10.24.8.10 to PLC-11 via firewall FW-OT-01 — High-tier probe - populated OT network diagram (Purdue zones, IP addressing table, VLANs, PLC/RTU lists, conduit) (merged from global-top500-441-scada-network-diagrams)

Should not match

• Remote control for the television — Non-match 1
• System documentation for the website — Generic IT documentation outside industrial control
• The vendor guide introduces SCADA system architecture. — Product overview without a configuration record
• Training example: SCADA system documentation for RTU-07 at 10.24.8.15, Modbus register 40017 — Explicit training content must not enforce
• Training example: SCADA network diagram with Purdue level 2 zone, VLAN 120, HMI-02 at 10.24.8.10, and RTU-07 — Explicit training diagram with otherwise high-tier structure must not enforce (carried from global-top500-441-scada-network-diagrams)
• Records policy: SCADA network diagrams and the OT network topology register are retained for seven years and reviewed by the asset owner annually. — Policy text naming the diagram topic without diagram structure stays discovery-only
• News: the utility said its OT network topology was not affected by the ransomware incident at its corporate office. — News report mentioning the topic without structure stays discovery-only

Known false positives

• Vendor manuals, standards, and engineering courses discuss SCADA, PLCs, HMIs, RTUs, and OT protocols without exposing a live system configuration. Mitigation: Keep document topics discovery-only and require point, tag, I/O, alarm, HMI, RTU, polling, protocol-map, or control-logic content for enforcement.
• Training labs can include realistic asset IDs, IP addresses, register numbers, tags, and node names. Mitigation: Reject explicit template, demo, tutorial, sample-data, and training-example framing from enforcing tiers.
• Vendor reference architectures, IEC 62443 and Purdue-model courseware, and OT security standards describe zones and conduits, Purdue levels, DMZs, and remote sites without exposing a live topology. Mitigation: Diagram structure alone reaches 75 only alongside a SCADA/ICS/OT network-diagram topic; 85 additionally requires a populated node, address, subnet, VLAN, register, or outstation value, and template/training framing is excluded.

References

• Security of Critical Infrastructure Act 2018 (Cth)
• Criminal Code Act 1995 (Cth)