It retells the December 2015 attack on three Ukrainian power companies: the screens taken over, the backup power cut, the phones flooded, and crews restoring power by hand within hours.
ICS/OT Incident Response Drills and Exercises
Make Sure the First Test of Your OT Incident Response Plan Is a Drill, Not the Real Thing
Utilities under NERC CIP-008-6 must test their incident response plan at least once every 15 months. This edition shows you how to start small: one line of your plan, one question, a 15-minute drill your night shift can run.
Built on public sources: CISA Tabletop Exercise Packages, NERC CIP-008-6, the TSA Security Directives, and the E-ISAC and SANS analysis of the Ukraine attack
What the Book Stands On
Real incidents and public guidance, not opinion
Follows Norsk Hydro through the 2019 ransomware attack: the network cut, plants switched to manual operation, no ransom paid, and a public briefing every day while it recovered.
The exercise formats draw on the public CISA Tabletop Exercise Packages, and the testing chapters follow what NERC CIP-008-6 and the TSA pipeline directives require you to test.
What You'll Learn in this Book
Twenty chapters in six parts, 329 pages, from auditing the plan you have to designing and running your own drills, plus eleven printable templates
- Why a plan on file is not a tested plan, and how to audit yours for what an IT template leaves out
- How to define safe states and manual fallback before the day you need them
- What an operator should report, and when, using a layer-by-layer list of OT indicators of compromise
- How to run two kinds of tabletop: one for the executives who make the shutdown call, one for the technicians who work the playbook
- Who must be told and by when, and what NERC CIP-008-6 and the TSA directives expect as test evidence
- How to turn findings into fixes with an after-action report, and plan a year of drills around your outages
- How to design a 15-minute drill in six steps, from one line of your plan
- Three drill cards worked in full: a USB stick at console 3, a breaker SCADA calls closed while the crew says open, and a vendor session nobody booked
- How to build a tabletop in six steps, from scope to the package your facilitator carries into the room
- How to run the room: what to do when it goes quiet, or one voice takes over
- How to debrief in five minutes, then run the drill again and record what changed
- Exercise QUIET FEEDER: a ransomware tabletop at a fictional electric cooperative, written out in full
Get the Book and the 11 Templates for $9.99
Total value $164.99. Yours today for $9.99. PDF and EPUB, to download after checkout.
Everything You Get for $9.99
The book, eleven printable templates and both formats, ready to download after checkout
-
The Book, PDF and EPUB
Twenty chapters in six parts, 329 pages, from auditing the plan you already have to running a full exercise. Two real incidents told from the responder's side, the four-hour QUIET FEEDER ransomware tabletop written out in full, and three drill cards worked from start to finish. Print the PDF for the exercise room, or read the EPUB on a phone or tablet.
$9.99value -
The Drill Design Kit
The worksheet walks one line of your plan through the six steps of Chapter 15: one objective you can see or hear, the situation in the words of the shift, a first question that forces a commitment, the backup fact, what good looks like, and the decision. The two-sided card holds the finished drill: the player side for the shift, the exercise lead's side with the answer. Fifteen minutes, one card, any shift.
$27value -
The Tabletop Build Workbook
Build a full tabletop on paper in the six steps of Chapter 17: scope on one page, objectives you can score, a short story told in modules, injects that force a decision, what good looks like, and the called-away test. You finish with an exercise package another person could run.
$27value -
The Exercise Lead Run Sheet
The exercise lead's script for the day, from Chapter 18: the first words, the ground rules and what is simulated, when to play a backup fact or a backup inject, how to call time between modules, and how to close with the hot wash while the room still remembers what happened.
$17value -
The Plan Audit and Field Kit
Four references for before and during an incident. The plan audit checklist finds what an IT-style template left out of your OT plan. The OT indicators quick reference lists, layer by layer, what an operator should report and when. The OT IR field kit and the questions for consideration go with the people who respond.
$47value -
The Scenario, Recovery and Calendar Templates
Plan the year, not one event. The scenario design template builds scenarios that escalate in layers. The recovery readiness checklist asks whether your backups can actually be used when the vendor is overwhelmed. The 12-month drill cadence lays out a year of drills on one page, around planned outages and compliance deadlines.
$37value
Total value$164.99
Your price today, for everything above$9.99
You're Covered By Our 30-Day Money-Back Guarantee
If the book isn't what you needed, for any reason, write to us through the Contact page within 30 days of your order and we refund you in full.
Read the Refund Policy and Terms and Policies.
Who Wrote It
HK School of Management and Technology
HK School of Management and Technology trains the people who run the work: project managers, Scrum Masters, engineers and security teams. On the industrial side we teach the free Industrial Control Systems Introduction course and ICS/OT Cybersecurity Fundamentals on hksmnow.com.
This book is the companion to our ICS/OT Incident Drills and Tabletop Exercises course. This edition adds the hands-on side: designing short drills, building a tabletop and running the room. It puts the whole method in one place, so it can sit on the desk while you plan the exercise.
Get the Book and the 11 Templates for $9.99
Total value $164.99. Yours today for $9.99. Covered by our 30-day money-back guarantee.