Logging related to ICS components is often limited to process-relevant events. Data relevant to information security is often not recorded. As a consequence, security incidents can only be detected with difficulty and cannot be reconstructed after the fact.