Response
OT Incident Response Readiness
Be able to respond to an OT incident with operations, engineering and safety at the table.
Defensive guide
Why should I care?
IT playbooks assume actions that are unsafe in OT.
How to implement it
- Write OT-specific playbooks with engineering input
- Define who can authorise containment actions affecting the process
- Pre-agree evidence collection that does not disturb operations
- Exercise with operations staff, not only the security team
What good looks like
- Named decision authority
- Playbooks referencing real site procedures
- Regular joint exercises
Common failure modes
- Copy-pasted IT playbooks
- Security acting unilaterally on control systems
How to verify it
- Run a tabletop with a plant scenario and measure the decisions made
Go deeper