###### Abstract  
Due to the nature of the industrial control systems (ICS) environment, where process continuity is essential, intentionally initiating a cyberattack to check security controls can cause severe financial and human damage to the organization. Therefore, most organizations operating ICS environments check their level of security through simulated cybersecurity exercises. For these exercises to be effective, high-quality cyberattack scenarios that are likely to occur in the ICS environment must be assumed. Unfortunately, many organizations use limited attack scenarios targeting essential digital assets, leading to ineffective response preparedness. To derive high-quality scenarios, there is a need for relevant attack and vulnerability information, and standardized methods for creating and evaluating attack scenarios in the ICS context. To meet these challenges, we propose GENICS, an attack scenario generation framework for cybersecurity training in ICS. GENICS consists of five phases: threat analysis, attack information identification, modeling cyberattack scenarios, quantifying cyberattacks, and generating scenarios. The validity of GENICS was verified through a qualitative study and case studies on current attack scenario-generating methods. GENICS ensures a systematic approach to generate quantified, realistic attack scenarios, thereby significantly enhancing cybersecurity training in ICS environments. c 2024 14 768 202  
awareness training to all users of information systems. In addition, the Cybersecurity and Infrastructure Security Agency (CISA), a primary U.S. agency in charge of cybersecurity, published \"Cybersecurity Incident and Vulnerability Response Playbooks\" [7]. This publication helps to plan to respond to cybersecurity incidents and vulnerabilities in federal civilian executive branch (FCEB) information security systems. Other countries enact laws to protect their businesses and assets. For simulated cybersecurity exercises to be effectively conducted in the ICS environment, high-quality cyberattack scenarios that are highly likely to occur in the ICS environment should be assumed. The cyberattack scenarios are mainly written from the attacker's point of view and describe in detail the procedures they go through to achieve the attacker's objective. In order to write such a cyberattack scenario, information such as assets and network topology included in the ICS environment should be collected. Unfortunately, most organizations repeatedly use limited attack scenarios for training against some essential digital assets. If cyber exercises are conducted with limited attack scenarios, the adequacy of the organization's security controls to protect its assets cannot be verified appropriately. Furthermore, the security controls cannot be revised to suit the organization. Therefore, a standardized framework that can derive various expected attack scenarios that can be applied to facilities is required for practical cyberattack response exercises in the ICS environment. There are several challenges to writing a high-quality cyberattack scenario. First, information on vulnerabilities for attacks that can be applied to assets within the ICS environment needs to be systematized. This not only reduces the understanding of the system but also makes it challenging to derive realistic scenarios for training. Furthermore, it is difficult to establish a response strategy for the hypothesized cyberattack scenario. Second, there is a lack of standardized methods for generating attack scenarios. This can lead to incomplete threat modeling by missing critical attack steps in the attack scenario. In addition, writing attack scenarios without a systematic methodology leads to inefficient training. Third, there is a lack of methods to evaluate the scenarios' quality. Measuring and evaluating the quality of the scenarios ensures the effectiveness of training and enhances participants' learning experience.