A secure industrial control system, comprising: an action originator for generating an action request for operating one or more industrial elements, the action originator comprising at least one of: an operator interface; an engineering interface; a local application interface; or a remote application interface; an action authenticator configured to sign an action request generated by the action originator, the action authenticator comprising a portable encryption device that can be carried with an operator or user that has authorized access to an interface (208, 210, 220, 216) of the action originator, the portable encryption device including: a storage medium with a private key stored thereon; and a processor configured to sign the action request with the private key; the portable encryption device configured to sign the action request from the action originator within the architecture of the portable encryption device so that an unauthorized person would have to physically take possession of the portable encryption device before being able to authenticate any action requests sent via the action originator; and a communications/control module in communication with one or more industrial elements, the communications/control module being configured to receive the signed action request, verify the authenticity of the signed action request, and perform a requested action when the authenticity of the signed action request is verified. an action originator for generating an action request for operating one or more industrial elements, the action originator comprising at least one of: an operator interface; an engineering interface; a local application interface; or a remote application interface; an action authenticator configured to sign an action request generated by the action originator, the action authenticator comprising a portable encryption device that can be carried with an operator or user that has authorized access to an interface (208, 210, 220, 216) of the action originator, the portable encryption device including: a storage medium with a private key stored thereon; and a processor configured to sign the action request with the private key; the portable encryption device configured to sign the action request from the action originator within the architecture of the portable encryption device so that an unauthorized person would have to physically take possession of the portable encryption device before being able to authenticate any action requests sent via the action originator; and a storage medium with a private key stored thereon; and a processor configured to sign the action request with the private key; the portable encryption device configured to sign the action request from the action originator within the architecture of the portable encryption device so that an unauthorized person would have to physically take possession of the portable encryption device before being able to authenticate any action requests sent via the action originator; and a communications/control module in communication with one or more industrial elements, the communications/control module being configured to receive the signed action request, verify the authenticity of the signed action request, and perform a requested action when the authenticity of the signed action request is verified.