Distributed control system configurations

Detects distributed control system configuration records: DCS configuration/database/tag-list wording with instrument tags and populated setpoints, alarm limits, controller nodes, card/channel assignments and IP addresses. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (an ISA-style instrument tag with loop number (TIC-204, FT-1101, XV-3302) or a populated configuration parameter (setpoint, alarm limits, range, gain/reset, mode, controller node, card/channel/slot, IP address)), and 85 needs two distinct structures plus independent DCS-engineering (control module, function block, PID, interlock, trip, historian, stations) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: IEC 62443, ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:distributed\s+control\s+system|DCS\s+(?:configuration|database|tag\s+list|point\s+list|I/O\s+list|export)|control\s+module\s+configuration|(?:DeltaV|Experion\s+PKS|CENTUM\s+VP|System\s+800xA|Ovation|SIMATIC\s+PCS\s?7)\s+(?:configuration|database|export|control\s+module|tag))\b

Corroborative evidence keywords

control module, function block, PID, interlock, trip, alarm priority, historian, engineering station, operator station, redundant controller

Proximity: 300 characters

Should match

The distributed control system upgrade is scheduled for the 2027 shutdown. — Discovery probe (65)
DeltaV configuration export - Unit 200 Setpoint: 365 degC Controller node: CTRL-07 — Medium-tier probe (75) - populated configuration parameters
DCS tag list - Unit 200 reactor TIC-204 control module PID, Setpoint: 365 degC, HH: 390, LL: 300 FT-2210 flow transmitter, Range: 0-120 m3/h XV-2302 trip valve on high-high temperature interlock Controller node: CTRL-07 (10.40.2.17), Card: 3, Channel: 12; alarm priority critical. — High-tier probe (85) - several instrument tags, populated parameters, IP and engineering context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: changes to the distributed control system follow the OT management-of-change procedure. — Policy text
DCS configuration template Setpoint: ________ Controller node: [insert] — Blank template
Course module 3: in a DeltaV control module, TIC-204 uses a PID function block with Setpoint: 365. — Training framing

Known false positives

Vendor DCS manuals and training describe control modules and tags. Mitigation: Guidance/training framing is excluded; 85 needs two instrument tags, populated parameters and engineering context.