Operating Mode Restriction

Where It Sits in the Scheme

4 ASOM-Fed techniques reach this countermeasure, across 3 forms of maneuver.

This is the direction the forward mapping cannot answer. A reader who works in D3FEND arrives holding D3-OPR and needs to know where it is employed in a scheme of maneuver — not which of MITRE's tactics it belongs to, which they already know.

Reached By

• M2.15 Safety Instrumented Layer IntegrityM2 Defense in Depth · T6 Operational Technology

  Keep the safety layer independent of the control layer, so a compromise of operations cannot defeat the function that prevents harm.

• M4.14 Control Protocol ConstraintM4 Obstacle / Canalization · T6 Operational Technology

  Permit only the industrial protocols and function codes the process requires, and deny engineering commands from outside the corridor.

• M8.03 Read-Only Service DegradationM8 Isolation / Retrograde · T4 Applications and Workloads

  Degrade mission services to read-only or queued operation rather than exposing or losing the corpus.

• M8.13 Safe-State IsolationM8 Isolation / Retrograde · T6 Operational Technology

  Sever the control network to a defined safe state that preserves the physical process, rather than a network state that abandons it.

Forms That Arrive Here

A countermeasure reached from more than one form is employed more than one way. D3FEND has no notion of a form, so this join exists only here.

• M2 Defense in DepthThe formEnsure no single failure is decisive.
• M4 Obstacle / CanalizationThe formForce the adversary onto ground you own and watch.
• M8 Isolation / RetrogradeThe formGive ground deliberately to preserve the force. Degrade gracefully; never fail open.

What This Does Not Claim

That a technique reaches a D3FEND countermeasure says the two describe the same defensive act. It does not say the countermeasure is deployed, configured, or working — that is an assessment finding about your estate, not a property of the framework.

MITRE's own entry for this technique is at d3fend.mitre.org, and it is the authority on what the countermeasure is. This page is the authority only on where it sits in ASOM-Fed. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation. This mapping is published by threatDefendr and is neither produced nor endorsed by MITRE.