The invention relates to a method for analyzing an abnormal event in an industrial automation and control system, IACS, comprising the following steps: identifying the abnormal event; detecting a root cause of the abnormal event; and generating a notification if the root cause is not a user activity and, if the root cause is a user activity, evaluating the possible impact on the IACS caused by the abnormal event, and generating a notification if the evaluation of the possible impact does not match a predefined list of allowable behavior. The present invention also relates to a corresponding system and corresponding computer program product comprising one or more computer readable media having computer executable instructions for performing the steps of the method.