ICS/OT Incident Response Drills and Exercises

ICS/OT Incident Response Drills and Exercises

Build the Plan. Test It on the Plant Floor. Prove It Works.

Most industrial sites have an incident response plan. Very few have tested it where it matters: on the plant floor, with operators in the room and the process still running. ICS/OT Incident Response Drills and Exercises shows OT engineers, security leads, and IT professionals how to turn a plan on paper into a capability that holds up at 2 a.m., in front of an auditor, and during a real attack.

What This Book Delivers

• A plan built for OT. Safe state, manual fallback, decision authority, and the escalation path that a generic IT plan leaves out.
• Exercises that expose real gaps. Executive and technical tabletops, escalating scenarios, the CISA exercise library, and the five scenario types every OT team should drill.
• Regulatory evidence that survives an audit. NERC CIP-008-6 and TSA pipeline testing and reporting obligations, and the records auditors actually ask for.
• Improvement that sticks. HSEEP after-action reports, improvement plans that get closed, drill metrics that matter, and backups you can actually restore.
• A program, not an event. A 12-month drill cadence, two real incidents told from the responder's side, and a full worked exercise.

Who It's For

• OT and control systems engineers and automation technicians responsible for incident response at their site.
• OT security leads who must design, run, and evaluate exercises and prove the results.
• IT security professionals extending incident response into industrial environments.

How It's Structured

• Chapters 1-4: the plan you are testing — why untested plans fail, the OT incident response lifecycle, safe state, and detection.
• Chapters 5-11: designing and running exercises, communication and regulation, after-action improvement, recovery, and the yearly cadence.
• Chapters 12-14: two real incidents and a complete worked exercise that brings every chapter together.