## 3 Laboratory Infrastructure  
The laboratory infrastructure used to check and evaluate the effectiveness of security features and the operation of systems in critical installations must reflect the real-world conditions in these facilities as closely as possible. Thanks to that, the test results will likely be reliable. Furthermore, assessing the performance of various solutions in a real operational environment is possible. We must stress that laboratory tests conducted under near-real conditions can show how the systems respond to different cyberattacks. Additionally, we can assess the consequences of possible software and hardware failures. Replicating the real process in the laboratory environment is essential for the effectiveness of the whole study. We aim to have a laboratory system whose behavior is very similar to that of the real process. In fact, the more similar the behavior of the laboratory system to the actual one, the higher the likelihood of detecting potential security vulnerabilities. For example, simulating the actual load on the IT/OT infrastructure, network, or the behavior of industrial equipment in the laboratory allows for the assessment of how systems respond to abnormal situations, such as overloads or failures which are possible in the mine but we are not typically allowed to cause within the real industrial process. A well-designed and implemented laboratory infrastructure provides predictability of the system behavior. It allows us to see how cyber threat detection and mitigation systems perform considering real or close-to-real industrial plant operation conditions. Thanks to that, we can assess whether and to what extent the designed systems can operate normally or close to normal in the event of a failure or emergency. As a result, we can assess whether the SCADA systems controlling industrial processes are resilient to simulated cyberattack attempts. Observing the laboratory process behavior greatly helps us to develop adequate detection methods and mitigation approaches. In addition to assessing the performance of existing solutions under abnormal situations, e.g., cyberattacks, laboratory tests help validate new solutions. Obviously, it is much safer, cheaper, and faster to conduct experiments with new algorithms and software and hardware tools in a fully controlled laboratory environment than in the real infrastructure. We can detect general misconceptions in the new approach and implementation errors thanks to such an approach. Consequently, when the new technologies are implemented in the actual industrial facility, we believe it will work as expected and greatly reduce the risk of problems. Finally, the consequences of abnormal situations, e.g., failures or cyberattacks, can be removed quickly and do not require financial expenses as in the real industrial setup. In the actual IT/OT infrastructure, the results of cyberattacks may require process reconfiguration, hardware or software alterations, or even shutdown. A well-designed and implemented test laboratory environment that mimics the behavior of the actual system can also be used to train process operators and engineers. In particular, the laboratory infrastructure allows for the evaluation of the efficiency of the detection and mitigation methods in a safe environment. We can consider not only the abnormal situations that have occurred in the past or are predicted to happen but also completely new ones that have never been experienced in the industrial setting. As discussed above, having a realistic test environment has many benefits. On the other hand, we must emphasize that properly designing and implementing a laboratory infrastructure that closely mimics the real industrial setup may be complicated, time-consuming, and expensive. In our case, replicating the full infrastructure of a mine in the laboratory required the technology, equipment, and control systems similar to those of a real facility.