Breaking down MITRE ATT&CK for ICS techniques into MON Requirements?

Right now, my team is walking through each MITRE ATT&CK for ICS Technique to determine if each one is applicable to the client environment. After confirming their applicability, we're going to break down each technique into 1 or more monitoring requirements to hands off to engineering. Curious if anyone has taken an approach like this and could share methodology/etc.?

Reference: [https://attack.mitre.org/techniques/ics/](https://attack.mitre.org/techniques/ics/)

amp att ck cybersecurity down ics mitre mitre att&amp requirements