Industrial Control System / OT Incident Response

ICS / OT Incident Response: A Guide to Industrial Cyber Resilience

This free SANS poster provides practical guidance for building and executing OT incident response plans in industrial environments. It outlines how to adapt traditional cybersecurity practices for Operational Technology (OT) systems, focusing on the unique needs of industrial control systems (ICS), critical infrastructure, and safety-critical operations.

What You’ll Learn:

• Key differences between IT and OT incident response, including system architecture, safety priorities, and legacy constraints.
• Essential components of OT cyber incident response, from asset inventory and network monitoring to triage, containment, and recovery.
• How to establish a Safe Cyber Position, a tested configuration that prioritizes safety while enabling containment and threat eradication.
• Roles and responsibilities in OT IR, including coordination with engineering, safety, and physical security teams.
• Real-world tabletop exercises and jump bag checklists, designed to improve readiness for ransomware, unauthorized access, or physical-cyber attacks.
• Steps to build a converged IT/OT incident response plan, incorporating threat intelligence, forensics, and regulatory compliance (e.g., CIRCIA 72-hour reporting).