## 2 Governor Concept  
In this section, first, we provide the fundamental concept of the governor and, second, we discuss the various attack scenarios in different CPS where a governor can/cannot be used and how.  
The concept of the security reference monitor allows a system to provide security to its functionality in order to operate at the boundary of a trusted and untrusted domain [25]. It has the following properties: it cannot be bypassed and altered and can be verified and tested. The governor is based on the concept of the reference monitor, which is responsible for evaluating the commands that are issued by the system's higher-level function in regard to whether they are required and safe for the local system. It makes such a decision based on the state information it maintains through communication with other governors and the system's components. Table 1 discusses various scenarios where a governor is useful and why.  
In Attack 3, an adversary has compromised a botnet of microwaves and network printers, and the attacker sends turn on/off commands remotely. Such an attack is not possible to be prevented by a governor since devices do not involve a feedback loop before initiating or closing their service. It is difficult for a governor to decide whether commands are legitimate because commands are originated from the legitimate compromised server. For similar reasons, Attack 4 is not possible to be prevented by a governor, where there is an adversary-compromised smart meter to control distributed energy resources (DERs) and end devices in a home. Since an adversary has compromised a system through they (legitimately) control edge devices, either through a cyber system or mobile app, it is difficult to detect whether commands issued are required and safe for the system or the device itself.  
In the case of a thermostat (Attack 1), it decides whether to turn on/off the heat based on the current temperature. If a customer physically specifies the rule on the device to not turn off the heat if the temperature is below X and an adversary sends a malicious command remotely to turn it off, this type of attack can be prevented by the governor. The governor placed on the device containingthe temperature sensor will enforce the security policy to not to turn off the heat if the temperature is below X. For a similar reason, Attack 2 can be prevented since a circuit breaker takes action based on the current readings from the system. In these scenarios, we place the governor near the edge devices and enforce a security policy to prevent attacks that control their functionality directly.  
In some cases, a governor can be used to prevent attacks at the locations from where commands are originated based on the state information. For instance, in Attack 5 and 6, DRAS in the cyber domain sends load curtailment commands to the customers who have enrolled in the DR functionality to curtail load in response to contingency. An adversary compromises the DRAS server and sends malicious load curtailment commands. The governor placed adjacent to DRAS will capture these commands and enforce a security policy before allowing commands to go through. It checks whether load curtailment command is required and safe for the system based on the state information it maintains. In this scenario, a governor is placed where commands are originated, not near the edge devices.  
All these attack scenarios elucidate that it is possible to prevent those attacks where commands are issued from a compromised cyber domain that is responsible for controlling functionality, and end devices must have a feedback loop to make a decision.