Detection of Change Operating Mode

Monitor ICS management protocols for functions that change an asset’s operating mode.
Monitor device application logs which may contain information related to operating mode changes, although not all devices produce such logs.
Monitor alarms for information about when an operating mode is changed, although not all devices produce such logs.