An older controller can only be updated during a production shutdown. An immediate patch would stop the plant for longer. Work through the change request, decide how to handle the risk until the maintenance window and record the time-limited exception for follow-up.
Compare temporary access restrictions with a later update or replacement. Assign decision, implementation and review roles, and enter the exception’s expiry date and a review point in your exception and action register. If the maintenance window is cancelled or active misuse is detected, reassess the procedure and escalate under the case conditions.
Use a non-sensitive asset overview or the case study. The course does not involve live controllers; technical protection and operating approvals remain with the responsible specialists.
What you will work on
Define OT lifecycle risks and associated decision needs
Assign change, exception and risk acceptance responsibilities
Address a cancelled maintenance window with an interim measure
Who it is for
Plant and operations leaders
CISOs and OT security leaders
Technical asset owners
Topics
OT operating conditions and lifecycle
Asset ownership and security roles
Change and exception decisions
Investment and compensating measures
Evidence and review of decisions
Your result
Your OT exception and action register records plant conditions, interim measures, maintenance windows and ownership. Use it to track changes and time-limited exceptions.
Prerequisites
Experience in asset operations, OT/IT security or technical management. A non-sensitive asset overview or a case study is sufficient.
Format and approach
Planned as eight to ten hours of self-study with case work, model development and self-checks. You work on an exception and action register.
Unusual network traffic affects a production controller. Disconnecting it immediately could stop the process in an uncontrolled way. Compare response options and prepare a guide for decisions and restart.
AI governance needs clear decision rights for business owners, security, operations and other control functions. You jointly design approval and ongoing controls for an AI use case. Using a case, you practise reviewing results, handling deviations and repeating checks after changes.
During a security incident at an energy utility, operations, IT/OT and management need to know who decides and when to involve others. Develop an incident plan for a supply area, including responsibilities and deputies, for discussion with management.