A secure industrial control system, comprising: one or more industrial elements, the one or more industrial elements including one or more input/output modules configured to be communicatively coupled to a field device; and a set of redundant communications/control modules that drive the one or more industrial elements, each of the redundant communications/control modules including at least one respective processor and a respective non-transitory medium that stores instructions executable by the processor; the set of redundant communications/control modules including a first communications/control module and a second communications/control module, the first and second communications/control modules (106A, 106B) configured to monitor and control the one or more input/output modules, the first and second communications/control modules (106A, 106B) being further configured to perform an authentication sequence, the authentication sequence including: transmitting a request datagram from the first communications/control module to the second communications/control module, the request datagram including a first nonce, a first device authentication key certificate, and a first identity attribute certificate; transmitting a response datagram from the second communications/control module to the first communications/control module, the response datagram including a second nonce, a first signature associated with the first and second nonces, a second device authentication key certificate, and a second identity attribute certificate; transmitting an authentication datagram from the first communications/control module to the second communications/control module when the response datagram is valid, the authentication datagram including a second signature associated with the first and second nonces; and transmitting a failed authentication datagram from the first communications/control module to the second communications/control module when the response datagram is invalid, the failed authentication datagram including a signature associated with the second nonce and an error message generated by the first communications/control module. one or more industrial elements, the one or more industrial elements including one or more input/output modules configured to be communicatively coupled to a field device; and a set of redundant communications/control modules that drive the one or more industrial elements, each of the redundant communications/control modules including at least one respective processor and a respective non-transitory medium that stores instructions executable by the processor; the set of redundant communications/control modules including a first communications/control module and a second communications/control module, the first and second communications/control modules (106A, 106B) configured to monitor and control the one or more input/output modules, the first and second communications/control modules (106A, 106B) being further configured to perform an authentication sequence, the authentication sequence including: transmitting a request datagram from the first communications/control module to the second communications/control module, the request datagram including a first nonce, a first device authentication key certificate, and a first identity attribute certificate; transmitting a response datagram from the second communications/control module to the first communications/control module, the response datagram including a second nonce, a first signature associated with the first and second nonces, a second device authentication key certificate, and a second identity attribute certificate; transmitting an authentication datagram from the first communications/control module to the second communications/control module when the response datagram is valid, the authentication datagram including a second signature associated with the first and second nonces; and transmitting a failed authentication datagram from the first communications/control module to the second communications/control module when the response datagram is invalid, the failed authentication datagram including a signature associated with the second nonce and an error message generated by the first communications/control module. transmitting a request datagram from the first communications/control module to the second communications/control module, the request datagram including a first nonce, a first device authentication key certificate, and a first identity attribute certificate; transmitting a response datagram from the second communications/control module to the first communications/control module, the response datagram including a second nonce, a first signature associated with the first and second nonces, a second device authentication key certificate, and a second identity attribute certificate; transmitting an authentication datagram from the first communications/control module to the second communications/control module when the response datagram is valid, the authentication datagram including a second signature associated with the first and second nonces; and transmitting a failed authentication datagram from the first communications/control module to the second communications/control module when the response datagram is invalid, the failed authentication datagram including a signature associated with the second nonce and an error message generated by the first communications/control module.