v3.6.0 — Domain 18: OT/ICS Security
What's New
Domain 18: OT/ICS Security (NEW)
New domain covering Operational Technology and Industrial Control System security — the first dedicated OT security domain in the plugin.
Reference file: references/ot-ics-security.md (814 lines, 10 sections)
Frameworks covered:
- NIST SP 800-82 Rev.3 — OT security guide
- IEC 62443 (ISA/IEC) — Industrial automation and control system security
- Purdue Model / ISA-95 — OT network segmentation architecture
- MITRE ATT&CK for ICS — ICS-specific TTPs
- NERC CIP — Electric grid reliability standards
Key content:
- IT vs OT comparison table (priorities, protocols, lifespan)
- Purdue Model 6-level ASCII diagram with firewall/DMZ placement
- IEC 62443 zones and conduits architecture + Security Levels SL 1-4
- OT asset discovery (passive vs active) with tool recommendations (Claroty, Nozomi, Dragos, Tenable.ot)
- Industrial protocol analysis (Modbus TCP, DNP3, OPC UA, BACnet, EtherNet/IP, PROFINET)
- MITRE ATT&CK for ICS technique mapping (T0858, T0855, T0831, T0886, etc.)
- Safety-first OT incident response decision tree
- PLC/HMI/SCADA hardening checklists
- Thai CII context under พ.ร.บ. ไซเบอร์ 2562 (Energy, Water, Transport, Healthcare, Telecom, Finance, Government)
- Quick Win / Standard / Advanced implementation checklist
Minor Enhancements
- D4 (SOC Operations): Added SIEM/XDR Platform Options table — Splunk, Elastic Security, Microsoft Sentinel, Defender XDR, Google Chronicle, Wazuh, IBM QRadar
- D9 (Compliance Frameworks): Added CIS v8.1 Asset Class Mapping table (Devices, Software, Data, Users, Network) with OT Relevance column
- D11 (Zero Trust Architecture): Added MCRA (Microsoft Cybersecurity Reference Architecture) as vendor-specific implementation reference alongside NIST 800-207
- D10, D16: Added cross-references to D18
Infrastructure
frameworks.json: 50 → 54 entries (+NIST 800-82, IEC 62443, Purdue Model/ISA-95, MITRE ATT&CK for ICS)- Updated all supporting files: CLAUDE.md, validate-plugin.sh, smoke-test-prompts.md, INSTALL.md, CHANGELOG.md
Stats
- 16 files changed: 1,075 insertions, 61 deletions
- 18 domains total (up from 17)
- 54 frameworks tracked in frameworks.json
- Validation: 60 PASS, 0 FAIL, 0 WARN