SCADA
Also known as: supervisory control and data acquisition, industrial control system, ICS, OT system, HMI
SCADA (Supervisory Control and Data Acquisition) is a category of industrial control system (ICS) used to remotely monitor, control, and record data from distributed physical infrastructure, including power grids, water treatment plants, oil and gas pipelines, manufacturing facilities, and transport networks.
SCADA systems collect sensor data from remote field devices (via RTUs or PLCs), display it to operators on centralised monitoring screens, enable remote control commands, and record historical data for analysis and compliance.
SCADA, explained at three levels
At home
SCADA is a control room for large physical systems. Imagine you are responsible for the electricity supply across an entire city. You cannot visit every substation and generator in person all day: SCADA brings all that information to a central screen, showing you the status of every sensor, alarm, and control point across the network. If a valve needs closing or a generator needs starting, you can send the command from the control room. SCADA is what keeps the lights on, the water flowing, and the trains running.
At work
For operations managers in utilities, energy, water, and manufacturing, SCADA is the foundational system for real-time operational visibility and control. SCADA provides the historical data record (historian) needed for process analysis, regulatory reporting, and maintenance planning. Integration between SCADA historians and enterprise systems (ERP, asset management) is a common project to enable operational data to inform business decisions: for example, linking energy consumption data from SCADA to the finance system for energy cost accounting.
At home
A SCADA system has four main components: field devices (sensors, actuators, and controllers installed at the physical infrastructure that measure conditions and execute control commands); remote terminal units (RTUs) or programmable logic controllers (PLCs) at the field sites that translate between the physical devices and digital communication; communication infrastructure (radio, fibre, cellular, or satellite links connecting field sites to the control centre); and the master station (the central SCADA server with historian database and HMI (human-machine interface) screens that operators use).
At work
SCADA security is a critical concern for critical national infrastructure. Traditional SCADA systems were designed as isolated, air-gapped systems where physical isolation provided security. The gradual integration of SCADA systems with corporate IT networks and the internet (for remote monitoring, vendor access, and data sharing) has created vulnerabilities. The US Cybersecurity and Infrastructure Security Agency (CISA, which absorbed ICS-CERT), the UK NCSC, and the Canadian Centre for Cyber Security all publish specific guidance for OT (operational technology) security. Key SCADA security principles: network segmentation between OT and IT, strict access controls for remote access, patch management adapted for the availability-critical nature of OT systems, and supply chain security for SCADA components.
At home
The convergence of IT and OT (information technology and operational technology) is a major trend in SCADA and industrial control. Traditionally, SCADA and IT systems were completely separate: different networks, different protocols, different security models. The industrial Internet of Things (IIoT) and digital twin trends are driving integration between SCADA historians and IT analytics platforms, enabling advanced analysis of operational data alongside business data. This convergence creates both value (better decisions using combined data) and risk (OT vulnerabilities from IT integration pathways).
At work
From a practitioner standpoint, SCADA system projects have distinct characteristics from enterprise IT projects: availability requirements are typically 99.9%+ (planned downtime windows are very limited), change management is more conservative (changes must not disrupt control of critical infrastructure), and the system's operational technology lifecycle is much longer (SCADA systems often run for 20-30 years, meaning systems designed in the early 2000s with pre-cybersecurity-era architectures are still in production). Requirements for SCADA modernisation projects must account for these constraints, and migration strategies must maintain continuous operational availability.
Real-world examples
At home
When a water pipe burst in Nadia's city one winter evening, she wondered how the water company knew where the problem was so quickly. The answer was their SCADA system, which monitors pressure sensors throughout the distribution network. The sudden pressure drop in one zone was visible to operators immediately, who could pinpoint the likely location before any physical inspection.
At work
A regional electricity distribution company undertook a SCADA modernisation programme to replace a 20-year-old control system. The project required maintaining 99.9% availability throughout the migration: a 24-hour outage window had not been possible since the 1990s. The project team used a parallel-run strategy: installing the new SCADA alongside the legacy system, migrating individual substations one at a time while the legacy system remained operational, and only cutting over when the new system had proven reliable for each site.
Common confusions
- SCADA and PLC are not the same thing, though they work together. A PLC (Programmable Logic Controller) is a field-level device that directly controls physical equipment and performs local automation logic. SCADA is the supervisory system that communicates with many PLCs (and RTUs) across a facility or network, providing centralised monitoring, data collection, and high-level control. Think of PLCs as the local controllers and SCADA as the overarching management system above them.
- Air-gapped SCADA systems are not inherently secure. Many older SCADA systems were designed with the assumption that physical isolation from the internet provided complete security. But Stuxnet demonstrated that air-gapped systems can be compromised via USB drives, and many 'air-gapped' SCADA systems have been inadvertently connected to corporate networks through vendor access laptops, USB connections, or IT/OT convergence projects. Physical air-gapping is a security layer, not a guarantee, and must be actively maintained.
- SCADA and DCS (Distributed Control System) serve different use cases. DCS is typically used for continuous process control (refineries, chemical plants) where tightly coordinated, high-speed control of many variables is needed at a single site. SCADA is typically used for geographically distributed infrastructure where the priority is monitoring and supervisory control rather than tight, coordinated process control. In practice, many modern systems blur this distinction.
For analysts
In BA artefacts, SCADA requirements surface in operational technology system specifications, IT/OT integration projects, and critical infrastructure security assessments. When documenting integration requirements between SCADA historians and enterprise IT systems, include: 'Data transfer from the OT network (SCADA historian) to the IT network (enterprise analytics platform) must occur via a unidirectional data diode, ensuring no data or commands can flow from the IT network into the OT network. The data transfer mechanism must be approved by the OT security team before implementation.' Include availability requirements: 'The SCADA system must maintain 99.9% availability. Any changes to SCADA configuration, software, or connectivity must follow the change management procedure including a risk assessment reviewed by the OT security team.'
History & origin
SCADA systems evolved from the need to remotely monitor and control infrastructure spread across large geographic distances: power lines, pipelines, and water systems too dispersed for local manual control at each site. Early SCADA systems in the 1960s-70s used proprietary hardware and dedicated communication lines. The shift to networked SCADA systems from the 1990s introduced TCP/IP connectivity for lower-cost communication but also introduced cybersecurity risks that were not present in isolated proprietary systems. The 2010 Stuxnet attack (widely described as the first known cyberweapon, which targeted the Siemens control systems running Iranian uranium-enrichment centrifuges) marked a pivotal moment in awareness of SCADA security vulnerabilities and the geopolitical implications of ICS security.