Identifying a degradation of integrity of a process control system by checking the files expecting to be present in the system profile

Disclosed is a method to identify a degradation of integrity of a process control system. The method includes identifying a file on a file system of the process control system. Next, the method determines if the file is identified in a system profile, the system profile identifying the files expected to be present. A degradation of integrity of the process control system is identified when the file is not identified in the system profile. The method may compare the hash value of the file to a stored hash value. The method may also identify a network communication, compare a property of the network communication to a stored property of network communications in the system profile and identify a degradation of the process control system when the property does not match the stored property in the system profile.