Which ATT&CK matrix scopes an estate whose flat segment mixes office hosts with building-automation controllers?

## Why this is a decision and not a lookup An estate that is neither pure office nor pure plant forces a choice that looks technical and is mostly organisational. A flat office segment carries laptops, a print server, IP cameras and two building-automation controllers on one broadcast domain. Somebody asks which ATT&CK matrix the estate is measured against. Naming a matrix is naming a set of adversary goals you accept as in scope. That is why the answer allocates work and budget, and why it cannot be settled by asking which matrix has more techniques. ## What each single-matrix answer actually decides **Enterprise only.** Convenient, and it matches how the organisation is staffed. But the ICS matrix exists precisely because Enterprise has no columns for impairing process control or inhibiting a response function. Choosing Enterprise alone declares those goals out of scope for an estate that physically contains the devices they apply to. Nothing in the resulting document is false; the omission is the decision. **ICS only, or ICS wholesale.** Overcorrection. Applying the ICS matrix across an estate that is 95% laptops means claiming to address columns that have no meaning for a print server, and it changes who the document is addressed to. It also tends to import an asset owner — facilities, or their contractor — who was never asked and has no obligation under the assessment's terms of reference. **Both, per asset group.** The defensible answer. Enterprise scopes the office hosts, ICS scopes the two controllers, and the two results are reported against two named matrices with two denominators. No blended percentage, because there is no shared denominator to blend. ## The crossing point is the deliverable The interesting output of the split is not either mapping. It is the thing that falls between them: the shared broadcast domain. The adversary position that matters here is unauthenticated, on the segment, with no account anywhere — reachability is the whole of the access. A commodity criminal firing one public exploit at every reachable instance does not need to be sophisticated to reach a controller that will obey any protocol-legal command, because the control protocol's specification contains no authentication at all. That has a hard consequence for control selection. There is no patch, because nothing is broken. There is no setting to enable, because the specification never defined one. Credential controls do not apply, because there is no credential in the exchange. The only class of control that removes what this depends on is one that removes reachability between the office segment and the controllers. Every other class leaves the dependency intact. ## Where the organisational constraint bites Three constraints usually apply at once, and a principal-level answer names them rather than assuming them away: 1. **Ownership.** Building automation is frequently owned by facilities, not IT, and operated under a maintenance contract. The people who can change the controllers do not report to the people who commissioned the assessment. 2. **Contractual refusal.** Maintenance terms commonly prohibit configuration change and void support for anything the vendor did not install. The contractor can simply decline, and be within their rights. 3. **Replacement economics.** The controllers may have a fifteen-year service life and no authenticated successor product. "Replace them" is a capital project on someone else's plan, not a remediation item. So the achievable outcomes are usually: reduce reachability with something IT owns and can change unilaterally; accept the residual with a named accepting owner and a review date; and put an authentication requirement into the next contract renewal or refresh cycle, since that is the only moment the constraint moves. ## What to say in the room A strong answer does four things. It refuses the single-matrix question and says why the framing is the problem. It proposes scoping per asset group with two named denominators. It elevates the shared segment from an implementation detail to the finding, because that is where the two matrices meet and where the only effective control class sits. And it names an owner and a decision route for the part IT cannot fix — including the possibility that the correct outcome is a documented, accepted, reviewed risk rather than a fix. The failure mode to avoid is a tidy document. Picking one matrix produces a cleaner report and hides the one conclusion that needed a budget holder's signature.