Detection of abnormal configuration changes

An industrial automation and control system, IACS, comprising:

• an identification unit configured to identify an abnormal event;
• a detection unit configured to detect a root cause of the abnormal event;
• and
• a generating and evaluating unit configured to generate a notification if the root cause is not a user activity and, if the root cause is a user activity, configured to evaluate the possible impact on the IACS caused by the abnormal event, and generating a notification if the evaluation of the possible impact does not match a predefined list of allowable behavior.

A computer program product for analyzing an abnormal event in an industrial automation and control system, IACS, and comprising one or more computer readable media having computer executable instructions for performing the steps of:

• a) identifying the abnormal event;
• b) detecting a root cause of the abnormal event;
• and
• c) generating a notification if the root cause is not a user activity, and, if the root cause is a user activity, evaluating the possible impact on the IACS caused by the abnormal event, and generating a notification if the evaluation of the possible impact does not match a predefined list of allowable behavior.