Managing OT Incidents Across Operations and Security
Inquiry This course is not yet bookable.
Unusual network traffic affects a production controller. Disconnecting it immediately could stop the process in an uncontrolled way. Compare response options and prepare a guide for decisions and restart.
Compare full disconnection, limited isolation and monitored operation in terms of personal safety, plant condition and cyber risk. Assign operational decisions and technical checks, then develop a guide for approval, staged restart and fallback. If a new anomaly appears during restart, reassess the stop conditions.
Use your own non-sensitive plant description or the case study and take away your guide. Interventions on controllers and protective systems remain with qualified and authorised specialists.
What you will work on
Distinguish the safety, availability and cyber consequences of an option
Assign decision rights and technical assessment requests
Respond to a new anomaly during restart
Who it is for
Operations and production leaders
OT and IT security managers
Crisis leaders in technical operations
Topics
OT operating states and dependencies
Trade-offs in cyber response
Situation assessment and handovers
Restart and release criteria
Stopping, fallback and escalation
Your result
Your OT incident guide covers safe state, checks, approvals, restart and fallback. Use it for further coordination with the responsible specialists.
Prerequisites
Experience in technical operations or OT/IT security, and access to plant and process information. A non-sensitive plant description or a case study is sufficient.
Format and approach
The self-paced course is planned for 5–6 hours, with decision scenarios and self-checks with explanations.
An older controller can only be updated during a production shutdown. An immediate patch would stop the plant for longer. Work through the change request, decide how to handle the risk until the maintenance window and record the time-limited exception for follow-up.
During a security incident at an energy utility, operations, IT/OT and management need to know who decides and when to involve others. Develop an incident plan for a supply area, including responsibilities and deputies, for discussion with management.
Design a process for AI incidents, from reporting and limiting use through business review and a possible restart. Follow up decisions already influenced by an incorrect output.