An approach based on a hierarchical hidden Markov model for anomaly detection in industrial control systems is proposed. The signals of the system components are fed to the input of the proposed model. The hidden state is an independent probabilistic model, so each state is also a hidden Markov model. In the proposed model, the detection of anomalies according to the readings of the industrial control system sensors is combined with modeling at the event level. The model has several levels, and the event is modeled at the highest level. The approach is evaluated on a secure water treatment dataset and compared with the results of the previous work, which showed that the proposed model is better in terms of recall and F-measure metrics and amounted to 0.9164 and 0.9563, respectively.