A cyber monitored control system comprising: a controller comprising a first processing resource of a processing system operable to execute a control application for a controlled system; and a cyber monitor comprising a second processing resource of the processing system isolated from the first processing resource in processing circuitry and in different sections of a memory system of the processing system, the cyber monitor operable to: evaluate a plurality of inputs of the controller with respect to a cyber threat model; receive a plurality of built-in test results (220, 314) of diagnostics, the diagnostics executed to detect a problem within the processing system; apply trending using the cyber threat model to distinguish between a fault and a cyber attack, wherein the cyber threat model comprises a plurality of rules and/or characteristics that are indicative of the cyber attack; and isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack, wherein isolation of the one or more subsystems comprises disabling one or more sensors, communication buses, outputs, and/or other interfaces under the cyber attack; wherein the cyber monitored control system is coupled to a sensor system, and the cyber monitor is operable to compare a plurality of raw input data received from the sensor system with conversion logic outputs of the controller to verify conversion logic performance of the controller. a controller comprising a first processing resource of a processing system operable to execute a control application for a controlled system; and a cyber monitor comprising a second processing resource of the processing system isolated from the first processing resource in processing circuitry and in different sections of a memory system of the processing system, the cyber monitor operable to: evaluate a plurality of inputs of the controller with respect to a cyber threat model; receive a plurality of built-in test results (220, 314) of diagnostics, the diagnostics executed to detect a problem within the processing system; apply trending using the cyber threat model to distinguish between a fault and a cyber attack, wherein the cyber threat model comprises a plurality of rules and/or characteristics that are indicative of the cyber attack; and isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack, wherein isolation of the one or more subsystems comprises disabling one or more sensors, communication buses, outputs, and/or other interfaces under the cyber attack; wherein the cyber monitored control system is coupled to a sensor system, and the cyber monitor is operable to compare a plurality of raw input data received from the sensor system with conversion logic outputs of the controller to verify conversion logic performance of the controller. evaluate a plurality of inputs of the controller with respect to a cyber threat model; receive a plurality of built-in test results (220, 314) of diagnostics, the diagnostics executed to detect a problem within the processing system; apply trending using the cyber threat model to distinguish between a fault and a cyber attack, wherein the cyber threat model comprises a plurality of rules and/or characteristics that are indicative of the cyber attack; and isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack, wherein isolation of the one or more subsystems comprises disabling one or more sensors, communication buses, outputs, and/or other interfaces under the cyber attack; wherein the cyber monitored control system is coupled to a sensor system, and the cyber monitor is operable to compare a plurality of raw input data received from the sensor system with conversion logic outputs of the controller to verify conversion logic performance of the controller.