The Industrial Internet of Things (IIoT) has definitively crossed the line between passive observation and active control. Previously, edge devices and sensors primarily collected telemetry, but today they are directly integrated into automated control loops. Edge AI algorithms independently make decisions about changing technological modes, and operators remotely send commands via communication networks.
This technological shift creates new challenges for operational security. The updated NIST SP 800-82 standard establishes a critical requirement: as systems transition to active control, every automated and manual signal must have a complete and immutable audit trail. Without a dedicated Control Audit Layer, enterprises lose the ability to distinguish between human actions, algorithm errors, and unauthorized interference.
Evolution of IIoT: why active control changes classic OT security models
Traditional approaches to industrial automation were built on the assumption that control actions were generated exclusively within an isolated perimeter by local controllers or SCADA operators. However, the integration of advanced analytics destroys this isolation, blurring the boundaries between physical processes and external algorithms.
New interaction vectors include situations where an edge analytical model automatically adjusts pipeline pressure based on local sensor readings without operator involvement. In a parallel scenario, a remote command from SCADA initiates an emergency shutdown, which requires immediate verification for compliance with safety protocols. There is also a need to log manual override commands to clearly distinguish between human actions and automation.
Traditional SCADA systems are not designed for such convergent auditing. They record the fact that a parameter has changed but often fail to store the extended authorization context, creating blind spots for incident investigation and compliance assurance.
NIST SP 800-82 requirements: adapting control to availability priorities
According to the NIST SP 800-82 Guide to OT Security, protective measures in operational technologies must be adapted to environments where system availability is a higher priority than confidentiality. Any control and audit mechanism must not block or delay the execution of critical commands if doing so threatens personnel safety or equipment integrity.
In accordance with the NIST AI RMF 1.0 framework, the assessment of automated systems in critical infrastructure should focus on accountability, safety, and reliability, rather than just model accuracy. This requires the implementation of an architectural redundancy principle: event logging must occur in parallel and asynchronously to the main technological process.
Control Audit Layer architecture: connecting Edge, SCADA, and cloud
In accordance with the architectural principles of the AWS Well-Architected IoT Lens, reliability in IoT solutions is fundamentally established at the design stage of device-to-edge-to-cloud data flows. The Control Audit Layer performs this function for security, ensuring the interception and enrichment of command context (source identifier, state of adjacent sensors), reliable event transport, and storage in an immutable repository.
Standardization through OPC UA: data normalization before auditing
The main obstacle to end-to-end auditing is the heterogeneity of industrial protocols. To solve this problem, a unified integration standard is used — OPC UA. The platform-independent architecture of OPC UA is necessary for normalizing machine data before it is processed by SCADA or edge analytics systems. This allows for the combination of "raw" values with timestamps, security attributes, and quality statuses into a unified audit event format.
Practical implementation: building immutable logs without OT degradation
Implementing a Control Audit Layer requires synergy between specialized industrial tools and a robust enterprise transactional platform. Within the portfolio of the Intecracy Group alliance, this task is solved through the integration of the AZIOT platform and the UnityBase platform.
At the edge level, the AZIOT Platform is deployed. It collects data from sensors and controllers via Modbus or MQTT, performs normalization via OPC UA, and ensures reliable event buffering in case of connection loss. Alongside the execution of the technological command, AZIOT generates an audit package with metadata and sends it to the central level.
The core for storage and auditing is the UnityBase platform (a joint development of Intecracy Group companies). Thanks to an asynchronous architecture based on the SpiderMonkey JavaScript engine and a non-blocking HTTP server, UnityBase is capable of registering large volumes of audit events without delays. The platform's built-in security model (RBAC, RLS, and Audit Trail) ensures that audit log entries are protected from modification even by local SCADA administrators, fully complying with immutability requirements.
Checklist for IIoT architecture readiness for control action auditing
| Evaluation criterion | Requirement description |
|---|---|
| Source identification | Each control signal contains metadata that clearly defines the initiator (operator, Edge algorithm, cloud analytics). |
| IT control adaptation | A failure in the audit system does not block the execution of critical commands by local controllers (Availability priority). |
| Data normalization | All industrial signals pass through an OPC UA gateway to be converted into a unified format before being sent to the audit log. |
| Immutability of records | The audit log is protected from modification by local personnel using a role-based model (RBAC). |
| Alarm contextualization | The system records not only the fact of the command but also the state of adjacent sensors at the moment of its transmission. |
Implementing a Control Audit Layer ensures transparency and accountability of cyber-physical infrastructure, transforming disparate signals into a legally and technically significant basis for incident investigation and security support.
FAQ
How can NIST SP 800-82 requirements be adapted for legacy equipment that does not support authorization?
Adaptation is implemented at the edge gateway level. The gateway is placed next to the controller, intercepts unencrypted traffic (e.g., Modbus), authorizes requests, packages them into a secure OPC UA protocol, and asynchronously transmits the event to the central audit log.
What is the difference between standard SCADA logging and a dedicated Control Audit Layer?
Traditional SCADA logging focuses on technological changes and is often not protected from modification by local personnel. The Control Audit Layer aggregates extended context (source, legitimacy, current system state) and stores it in an isolated centralized repository with strict access control (RBAC/RLS) without the possibility of altering past records.
How can log immutability be ensured in an OT environment without the risk of stopping critical processes?
The key is adhering to the availability priority. Technological commands are executed instantly, while their copies for auditing are transmitted asynchronously via message brokers. Even during temporary unavailability of the audit server, command execution is not blocked, and events are buffered on the edge gateway.