Apparatus and methods for secure data logging

Secure data transfer from a process control system network comprising storing information received by a process controller 404, the information transferred uni-directionally from the process control system network to a data logger via a data node. In response to a trigger event being identified 406 on the network, the stored information is parsed for event data 414 and said event data is transferred from the data logger to a data extractor 420. The trigger event may be a safety-related event such as an appearance of an unexpected network node or a change in traffic pattern of the network. Parsing the event data may involve retrieving data from before and after the event 412.