BLOG

Definition of Cyber-Physical Systems: What They Are and Why Securing Them Is Different

Every industrial facility running today is a collection of cyber-physical systems, whether or not the people operating it use that term. The pumps, valves, motors, and reactors that move material through a process are governed by software that reads sensor data, executes control logic, and issues commands back to the physical world, continuously and in real time.

The term "cyber-physical system" has moved from academic research into mainstream industrial cybersecurity vocabulary over the past decade. Analysts, vendors, and regulators increasingly use it in place of, or alongside, older terms like OT and ICS. That shift is not just semantics. It reflects a real change in how these systems are built and where their vulnerabilities now sit.

This guide gives a precise definition of cyber-physical systems, explains how they relate to and differ from operational technology, industrial control systems, IoT, and IIoT, and covers why securing a CPS requires a fundamentally different approach from securing an IT network.

What Is a Cyber-Physical System? The Definition

A cyber-physical system is an engineered system in which computational elements monitor and control physical processes through a feedback loop, typically over a network, and often in real time.

The term was coined in 2006 by Helen Gill at the US National Science Foundation to describe the tight integration of computation, networking, and physical processes. The defining characteristic is the feedback loop: the physical process generates data through sensors, computation interprets that data and makes decisions, and those decisions are executed as commands to actuators that change the physical process. The loop runs continuously.

This distinguishes a CPS from a system that merely collects data about the physical world. A temperature sensor that logs readings to a database is not a cyber-physical system. A temperature sensor whose readings drive a control algorithm that adjusts a heating element, which then changes the temperature the sensor reads, is a cyber-physical system. The computation does not just observe the physical world; it acts on it.

The Four Layers of a Cyber-Physical System

Every cyber-physical system, regardless of scale or industry, is built from four functional layers:

Layer	Function	Example Components	Primary Security Concern
Physical layer	The process, equipment, or environment being controlled	Pumps, valves, motors, reactors, turbines, vehicles	Physical consequence of a compromised command
Sensing and actuation layer	Converts physical state to data, and data back to physical action	Sensors, transmitters, actuators, drives, final control elements	Signal falsification, actuator command injection
Computation layer	Executes control logic and decision-making	PLCs, DCS controllers, RTUs, embedded controllers, edge devices	Unauthorized logic modification, firmware compromise
Communication layer	Carries data between sensing, computation, and supervisory systems	Industrial protocols, network switches, wireless links, gateways	Command injection, eavesdropping, protocol manipulation

The computation layer is where PLCs and controllers sit, and it is the layer most frequently targeted in documented industrial cyberattacks, because compromising it gives an attacker direct influence over the physical process without needing to touch anything physical.

Cyber-Physical Systems vs OT, ICS, IoT, and IIoT

These terms overlap significantly and are often used loosely. The distinctions matter because they affect how you scope a security program and which standards apply.

Term	What It Means	Relationship to CPS
CPS (Cyber-Physical Systems)	Any engineered system where computation controls physical processes through a feedback loop	The broadest category. Includes ICS, IIoT, medical devices, autonomous vehicles, and building systems
OT (Operational Technology)	Hardware and software that detects or causes change by monitoring and controlling physical devices and processes	Effectively synonymous with industrial CPS. OT is the enterprise-facing term; CPS is the engineering term
ICS (Industrial Control Systems)	The control systems specifically used to manage industrial processes: SCADA, DCS, PLC-based architectures	A subset of CPS. All ICS are cyber-physical systems; not all CPS are ICS
IoT (Internet of Things)	Network-connected devices that collect and exchange data, typically consumer or commercial	Overlaps with CPS only where the device also controls a physical process. A connected thermostat is CPS; a connected doorbell camera is not
IIoT (Industrial IoT)	Connected sensors and devices deployed in industrial settings for monitoring, analytics, and optimization	A subset of CPS when actuation is involved. Often a monitoring-only overlay on existing CPS

The practical distinction: CPS is the term that scopes correctly when your environment includes more than traditional industrial control systems. A hospital with connected infusion pumps, a commercial building with automated HVAC and access control, and a refinery with a DCS are all operating cyber-physical systems. Only the refinery would be described as running ICS. If your security program needs to cover all three categories, CPS is the accurate scoping term.

Where Cyber-Physical Systems Are Deployed

Cyber-physical systems are the operating layer of most physical infrastructure. The industries below all depend on them, and each carries a distinct risk profile because the physical consequence of failure differs.

Industrial Process Control

Refineries, chemical plants, pharmaceutical manufacturing, and food production run continuous or batch processes governed by distributed control systems and safety instrumented systems. The physical consequence of a compromised CPS here ranges from product loss to a process safety event with consequences beyond the facility boundary.

Energy Generation and Distribution

Power generation plants, transmission substations, and distribution networks run CPS that manage grid frequency, switching, protection relays, and load balancing. These systems are geographically distributed, often remotely accessible, and subject to NERC CIP requirements in North America.

Water and Wastewater Treatment

Treatment plants use CPS to control chlorination, pH adjustment, filtration, and distribution pressure. Water utility cyber-physical systems carry a direct public health consequence: the Oldsmar, Florida incident in 2021 involved an attacker attempting to alter sodium hydroxide dosing levels remotely.

Manufacturing and Industry 4.0

Assembly lines, robotic cells, and automated material handling are CPS. Industry 4.0 has substantially expanded the CPS attack surface in manufacturing by connecting production systems to cloud analytics, ERP platforms, and vendor monitoring services.

Transportation and Autonomous Systems

Rail signaling, air traffic management, port automation, and autonomous vehicles are cyber-physical systems where the computational layer makes safety-critical decisions in real time. The automotive sector applies ISO/SAE 21434 and ISO 26262 to this class of CPS.

Healthcare and Medical Devices

Infusion pumps, ventilators, imaging systems, and surgical robots are cyber-physical systems where the physical consequence of compromise is direct patient harm. FDA premarket cybersecurity guidance now applies to medical device CPS.

Building Automation

HVAC control, access control, elevator systems, and fire suppression are building-level CPS. They are often the least secured category because they are procured and managed by facilities teams rather than IT or OT security functions, yet they frequently share network infrastructure with corporate systems.

Why Cyber-Physical System Security Is Different

The security requirements for a cyber-physical system are not the requirements for an IT system applied to different hardware. Four characteristics of CPS make the security discipline distinct.

The Consequence Is Physical, Not Informational

An IT security failure exposes data. A CPS security failure changes the physical world. A compromised controller can open a valve, stop a pump, disable an interlock, or alter a chemical dosing rate. This shifts the risk model from confidentiality-first to safety and availability-first, which is the foundational principle of OT security as a discipline.

Real-Time Determinism Constrains Security Tooling

CPS control loops execute on deterministic timing cycles measured in milliseconds. Security tools that introduce latency, consume processor cycles, or send unexpected network traffic can interrupt the control loop. This is why active vulnerability scanning, which is routine in IT, can crash PLCs and disrupt industrial operations. Passive methods are the only safe default in live CPS environments.

Long Lifecycles and Legacy Platforms

Industrial CPS have service lives measured in decades. A DCS commissioned in 2005 may still be running in 2030. Many deployed controllers have no authentication, no encryption, and no firmware update path. Security in these environments depends less on patching and more on architecture: network segmentation, access control, and compensating controls that limit what an attacker can reach.

Safety Systems Are Now a Deliberate Target

The TRITON malware, deployed against a petrochemical facility in 2017, specifically targeted safety instrumented system controllers with the objective of disabling the emergency shutdown function. This established that the safety layer of a CPS is itself an attack target, not just a passive protective feature. The convergence of functional safety and cybersecurity is the direct response to that threat class, and it is where IEC 61511 and IEC 62443 requirements intersect.

The CPS Threat Landscape

Attacks against cyber-physical systems follow recognizable patterns. The most common ICS and CPS attack vectors documented against North American critical infrastructure include:

Remote access exploitation: compromised VPN credentials or unprotected remote desktop connections providing direct access to the control network
Engineering workstation compromise: gaining access to the systems that hold programming software and credentials for controllers
Supply chain attacks: trojanized vendor software updates or compromised vendor remote access pathways
Protocol-level command injection: sending forged commands over industrial protocols that lack authentication
Living-off-the-land techniques: using legitimate operational tools already present in the environment to avoid detection

The documented incidents that define this threat class, Stuxnet in 2010, the Ukraine grid attacks in 2015 and 2016, TRITON in 2017, and the Colonial Pipeline ransomware incident in 2021, all share a common structure: the attacker reached the computation or communication layer of a cyber-physical system and used that access to affect physical operations.

Frameworks and Standards for Cyber-Physical System Security

Standard	Scope	Application to CPS
IEC 62443	Industrial automation and control systems	Zone and conduit architecture, Security Levels, component and system security requirements
NIST SP 800-82 Rev. 3	Operational technology security	OT-specific control guidance, asset inventory, monitoring, and risk management
NIST Cybersecurity Framework 2.0	All sectors and technology types	Governance and outcome framework; maps to IEC 62443 for technical implementation
IEC 61511	Safety instrumented systems in process industries	Clause 8.2.4 requires cybersecurity risk assessment as part of the safety lifecycle
ISO/SAE 21434	Road vehicle cybersecurity engineering	Automotive CPS security across the vehicle development lifecycle
NERC CIP	Bulk Electric System assets in North America	Mandatory controls for CPS in power generation, transmission, and control centers

For most industrial operators in North America, the practical approach is to use NIST CSF as the governance layer and IEC 62443 as the technical implementation layer. IEC 62443 provides the zone and conduit model that structures how a cyber-physical system is segmented, which controls apply to each zone, and what Security Level each zone needs to achieve based on its consequence profile.

How to Secure a Cyber-Physical System

A practical CPS security program follows a sequence that reflects how these environments are actually built and operated.

Establish asset visibility. Build a validated inventory of every device in the computation, communication, and sensing layers, including firmware versions and communication paths. Passive discovery is the appropriate method in live environments.
Map the architecture and consequence profile. Determine what each system controls physically, what happens if it is compromised, and which network pathways can reach it. This is the core output of an OT and CPS risk assessment.
Segment by consequence. Apply IEC 62443 zone and conduit architecture so that the highest-consequence systems are the hardest to reach. Safety systems belong in their own zone with strictly controlled interfaces.
Control access to the computation layer. Restrict who and what can reach programming interfaces on controllers. Hardening at the device and network level addresses default credentials, unused services, and unrestricted programming ports.
Govern remote access. Replace persistent vendor VPN connections with identity-based, session-governed access that can be audited and revoked.
Monitor passively and continuously. Deploy passive network monitoring on critical conduits to detect unauthorized commands, new devices, and programming events outside approved windows.
Integrate safety and security. For facilities with safety instrumented systems, run the cybersecurity risk assessment as part of the functional safety lifecycle rather than as a separate workstream.

Frequently Asked Questions

What is the simplest definition of a cyber-physical system?

A cyber-physical system is any system where software controls a physical process through a feedback loop of sensors, computation, and actuators. Sensors measure the physical state, software decides what to do, and actuators change the physical state, continuously. A thermostat controlling a furnace is a simple cyber-physical system. A refinery distributed control system managing hundreds of interlinked control loops is a complex one. The defining feature is that computation acts on the physical world, not just observes it.

Is a cyber-physical system the same thing as OT?

In industrial contexts they are effectively synonymous. Operational technology is the term used to describe the technology stack that monitors and controls physical processes in industrial facilities. Cyber-physical system is the broader engineering term that also covers medical devices, autonomous vehicles, building automation, and consumer systems. If you are describing a refinery control network, OT and CPS both apply. If you are describing a hospital infusion pump network, CPS applies and OT typically does not.

What are examples of cyber-physical systems in everyday life?

Anti-lock braking systems and adaptive cruise control in cars, smart thermostats that adjust heating based on occupancy, automated traffic signal systems that respond to vehicle flow, elevator control systems, and connected insulin pumps are all cyber-physical systems. Each one takes measurements from the physical world, processes them computationally, and issues commands that change physical behavior. The industrial versions operate on the same principle at larger scale and with higher consequence.

Why is the term cyber-physical systems being used more than ICS or OT?

Because the boundary of what needs securing has expanded. Traditional ICS security scoped to SCADA, DCS, and PLCs inside an industrial plant. Modern industrial environments also include IIoT sensors, edge computing devices, building automation, connected medical equipment in pharmaceutical facilities, and cloud-connected monitoring platforms. CPS is the term that covers all of them accurately. Security vendors and analysts adopted it because it scopes the problem correctly for environments that have grown well past the traditional ICS boundary.

Does IEC 62443 apply to all cyber-physical systems?

IEC 62443 was written specifically for industrial automation and control systems, so it applies directly to industrial CPS: manufacturing, energy, chemical, water, and similar sectors. Its core concepts, particularly zone and conduit architecture and Security Levels, are also applied by practitioners to CPS outside the traditional industrial scope, such as building automation and healthcare facility systems, because the underlying architecture principle holds. For automotive CPS, ISO/SAE 21434 is the sector-specific standard. For medical device CPS, FDA premarket cybersecurity guidance applies. See the IEC 62443 explained guide for how the standard is structured across its four parts.

Ready to secure your cyber-physical systems?

Arista Cyber helps industrial operators secure the systems that control physical processes, combining OT cybersecurity with functional safety expertise. Book a free consultation to discuss your environment.

Book Your Free Consultation at aristacyber.io