Who decides? Who may declare an incident, isolate a network, shut down a process or call the police, and who stands in when that person is off shift. Chapter 4 writes the command structure and decision rights into the plan.
“ICS/OT Incident Response Plan: Write One That Works”
How to Go From a Blank Page to an Approved Plan Your Operators Can Actually Use at 2 a.m.
In May 2023, one Danish energy company cut itself off from the internet and ran in isolation for six days. The sector's own report listed a rehearsed plan for exactly that among its lessons. This book shows you how to write yours.
BUILT ON PUBLIC SOURCES: NIST SP 800-61 AND 800-82, THE ISA/IEC 62443 SERIES, FEMA INCIDENT COMMAND, AND PUBLISHED INCIDENT REPORTS
THREE ANSWERS YOUR PLAN WILL GIVE
The three questions most plans dodge, and where the book answers them
What do the people on shift do in the first hour? Steps written for a tired operator: who acts, what they check, what is already authorized, and who gets told. Chapter 5 writes the procedures, starting with the first hour.
When is the plant safe to restart? Recovery objectives, stage gates and a separated sign-off, so "the servers are back" is never mistaken for "production is back". Chapter 6 defines recovered before you need it.
What You'll Learn in this Book
Ten chapters in four parts, about 280 pages, plus 22 templates and worksheets you can print and fill in
- How to get a sponsor, a charter and a planning team before you write a word
- What to ask in discovery interviews on every shift, and how to log the answers
- How to collect safe states and manual fallbacks, unit by unit
- How to define event, incident and emergency, with severity in the language of your plant
- How to write command roles and decision rights onto real plant jobs
- How to write a procedure step a tired operator can follow, starting with the first hour
- How to build a notification template and the matrix of who tells whom
- How to write recovery objectives and return-to-service criteria with sign-off
- How to turn the plan into playbooks and a one-page quick reference card
- How to get the plan approved, train people on it and keep it current
Everything You Get for $19.99
The method, the templates and a complete worked plan
THE BOOK: VALUE $19.99
ICS/OT Incident Response Plan: Write One That Works
Ten chapters in four parts, written in the order a real plan gets decided. Every chapter fills one chapter of a plan template, with the worksheets completed for Cedar Ridge, a fictional water treatment plant, so you see a finished answer before you write your own. Each chapter ends with a table of the standards and rules it relies on.
THE TEMPLATE LIBRARY: VALUE $49
22 Templates and Worksheets, Plus the Editable Files
The plan charter and project roadmap, the discovery interview guide, the safe state collection sheet, incident command role cards, a first-hour procedure template, an initial notification template, return-to-service sign-off sheets, an OT playbook template, a quick reference card template, and thirteen more. All 22 are printed in Appendix A, and one download adds the editable Word and Excel files and the filled Cedar Ridge examples, one folder per chapter.
INCLUDED IN THE BOOK PRICE
A Complete Plan, Start to Finish
Chapter 9 puts every chapter together into one complete plan for Kestrel Prairie, a fictional electric cooperative, from the first page to the last. Read it before you start, and keep it open while you write.
Total value: $68.99. Your price today: $19.99, one payment.
You're Covered By Our 30-Day Money-Back Guarantee
Read it for 30 days. If the book isn't what you needed, for any reason, write to us through the Contact page within 30 days of your order and we refund you in full. No questions, no conditions. The risk is ours.
Read the Refund Policy and Terms and Policies.
GET THE BOOK AND THE 22 TEMPLATES FOR $19.99
Total value $68.99. Yours today for $19.99. Covered by our 30-day money-back guarantee.