Get the authority first
Secure a sponsor, a charter and a planning team before you write a word.
For the person who has just been handed the plan
Write an OT Incident Response Plan That Actually Works at 2 a.m.
A chapter-by-chapter workshop that takes you from a blank page to an approved, usable plan for your industrial site, with the template, the worksheets and a full model answer.
30-day money-back guarantee · One payment, no subscription
8 SECTIONSEach one writes a chapter of your plan
40+ TEMPLATESPlus 21 worked examples and a full model plan
THE COMPLETE COURSE
ICS/OT Incident Response Plan: Write One That Works
$147 USD one payment
Half price, only with this order
Instant access. Covered by our 30-day money-back guarantee.
Already have an HKSM account? Use the same email at checkout and the course is added to it.WHAT IS THIS COURSE?
ICS/OT Incident Response Plan: Write One That Works is a workshop, not a lecture series. Each section makes one set of decisions with you, then a worksheet turns those decisions into one chapter of your site's plan.
You follow a demo water treatment plant, Cedar Ridge, through every chapter, so you always see a finished example before you write your own. At the end, you write a complete plan for a second site, an electric cooperative, and compare it with our model answer.
WHAT YOU'LL BE ABLE TO DO
Interview the people who know
Run discovery interviews with operators, maintenance and vendors, and log what you find.
Define what counts as an incident
Write severity in the language of your plant, with clear activation levels.
Settle who decides
Document command roles and decision rights: who declares, isolates, shuts down and calls outside help.
Write steps people can follow
Turn procedures into steps an operator can follow under stress, starting with the first hour.
Map who tells whom
Build a notification matrix and the legal clauses you can't fix after the fact.
Define "recovered"
Set recovery objectives and return-to-service criteria, with sign-off.
Build the readiness library
Write playbooks, checklists and a quick reference card for the control room.
Get it approved and keep it alive
Run review rounds, map the plan to the rules your site falls under, and set review clocks and training.
BUILT BY HK SCHOOL OF MANAGEMENT AND TECHNOLOGY
We teach the people who run, maintain and protect industrial systems. Our ICS/OT cybersecurity and OT incident drills courses both lead to the same document: the plan. This course is how you write it.
Students in 160 countries · 1,300+ five-star reviews across our courses
SECTION 1: BEFORE YOU WRITE
Planning the plan
Get the authority, the team and the boundary right, so the plan is approved instead of ignored.
Lesson 1.1
Why OT Response Plans Fail Before Anyone Writes Them
Lesson 1.2
Getting the Authority: Policy, Charter and Sponsor
Lesson 1.3
Building the Planning Team for an OT Site
Lesson 1.4
What the Rulebooks Require Your Plan to Say
Lesson 1.5
Drawing the Boundary: Scope Statement and Requirements Register
SECTION 2: GATHER THE INPUTS
Learn the site before you write
Find the critical functions, the worst-case scenarios and the safe states your plan must protect.
Lesson 2.1
Discovery Interviews: Who to Talk To Before You Write a Word
Lesson 2.2
Critical Functions and the OT Business Impact Analysis
Lesson 2.3
High-Consequence Events: Choosing the Scenarios Your Plan Must Cover
Lesson 2.4
Safe States, Manual Operation and the Plans You Already Have
Lesson 2.5
Jaguar Land Rover 2025: When One Incident Stops a Supply Chain
SECTION 3: DEFINITIONS AND CLASSIFICATION
Decide what counts, and how serious it is
Draw the lines between event, incident and emergency, and turn severity into clear activation levels.
Lesson 3.1
Event, Incident, Emergency: Drawing the Lines
Lesson 3.2
Severity in the Language of the Plant
Lesson 3.3
Two Axes, One Activation Level
Lesson 3.4
Toyota and Kojima 2022: When Someone Else's Incident Triggers Your Plan
SECTION 4: ORGANIZATION AND COMMAND
Who is in charge, and who may do what
Write the command structure, map it to real plant jobs, and settle decision rights before anyone needs them.
Lesson 4.1
Writing the Command Structure into the Plan
Lesson 4.2
Mapping Roles to Real Plant Jobs
Lesson 4.3
Decision Rights: Declare, Isolate, Shut Down, Call the Police
Lesson 4.4
Contacts, Vendors and Outside Partners
Lesson 4.5
Clorox 2023: When the Helpdesk Is Part of Your Response
SECTION 5: RESPONSE PROCEDURES
Steps that work under stress
Write procedures for the stressed reader, from the first hour to notification, legal and insurance.
Lesson 5.1
Why Plans Fail at 2 a.m.: Writing for the Stressed Reader
Lesson 5.2
Anatomy of an Executable Step
Lesson 5.3
The First Hour: Escalation, Evidence and Pre-Authorized Actions
Lesson 5.4
The Notification Matrix: Who Tells Whom, and When
Lesson 5.5
Counsel and Privilege: Writing the Legal Clauses
Lesson 5.6
Disclosure, Insurance and Things You Can't Fix Afterwards
SECTION 6: RECOVERY AND RETURN TO SERVICE
Define "recovered" before you need it
Set the four recovery numbers, write return-to-service criteria with sign-off, and put your vendors in the plan.
Lesson 6.1
Four Numbers That Define "Recovered"
Lesson 6.2
Writing Return-to-Service Criteria and Sign-Off
Lesson 6.3
Your Vendor Is Part of the Recovery Plan
SECTION 7: PLAYBOOKS AND THE READINESS LIBRARY
Turn the plan into tools people use
Build playbooks, checklists and the quick reference card your control room will actually pick up.
Lesson 7.1
The Readiness Library: Plan, Playbook, SOP, Checklist, Card
Lesson 7.2
Checklist, Flowchart or Table? Choosing the Format
Lesson 7.3
Writing an OT Playbook That Works at 3 a.m.
Lesson 7.4
Designing the Quick Reference Card
SECTION 8: MAKE IT REAL
Approved, trained and kept current
Get the plan through review, map it to the rules, and keep it alive with review clocks and training.
Lesson 8.1
Getting the Plan Approved: Review Rounds and the Compliance Annex
Lesson 8.2
Keeping the Plan Alive: Review Clocks, Update Triggers, Controlled Copies
Lesson 8.3
Training People on the Plan They Will Use
CAPSTONE: WRITE THE KESTREL PRAIRIE PLAN
A complete plan, start to finish
Write a full incident response plan for a fictional electric cooperative, then compare it with our model plan, chapter by chapter.
Lesson 9.1
Assignment Instructions
Lesson 9.2
Ten solution walkthroughs, one per task
WHAT YOU'LL HAVE WHEN YOU FINISH
A complete draft of your site's OT incident response plan, written chapter by chapter in the course template. A readiness library of playbooks, checklists and a quick reference card. A compliance annex that shows reviewers where each requirement is met. And the practice of having written one full plan already, for Kestrel Prairie, checked against a model answer.
WHAT STUDENTS SAY ABOUT OUR COURSES
★★★★★
"Very clear and crisp, straight to the point."
★★★★★
"Really useful. I will definitely be able to use many of these techniques and prompts. I was not expecting this to be so practical."
★★★★★
"I'm quite familiar with Lean from previous work, but this course is great because it gets to the point and explains concepts clearly. I don't feel like there's any wasted time."
★★★★★
"A great introduction to project management fundamentals. Clear explanations, well-structured content, and a solid starting point for absolute beginners."
QUESTIONS? ASK IN THE COURSE FORUM
Every lesson sits in our learning site, where you can ask questions in the course discussion forum.
HERE'S EVERYTHING YOU GET
The Course: 35 Video Lessons in 8 Workshop Sections
Every section writes one chapter of your plan, with the Cedar Ridge demo at each step.
VALUE: $147
The OT Incident Response Plan Template and Library
The plan template, plus 40+ templates, worksheets and checklists, and 21 worked Cedar Ridge examples.
VALUE: $97
The Capstone with a Model Answer
The Kestrel Prairie fact pack, a 44-page workbook, an 89-page model plan and ten walkthrough videos.
VALUE: $97
FREE BONUS
Industrial Control Systems Introduction
Our free 25-lesson course on PLCs, HMIs and SCADA, for anyone on your team who needs the basics.
VALUE: $97
TOTAL VALUE: $438
THE COMPLETE COURSE
ICS/OT Incident Response Plan: Write One That Works
$147 USD one payment
Half price, only with this order
Instant access. Covered by our 30-day money-back guarantee.
Already have an HKSM account? Use the same email at checkout and the course is added to it.OUR 30-DAY MONEY-BACK GUARANTEE
Take the course for 30 days. If it isn't what you needed and you have completed half of the course or less, write to us through the Contact page. We refund you in full, no argument. The risk is ours, not yours.
Read the Refund Policy and Terms and Policies. Questions? Contact HK School of Management and Technology.
QUESTIONS? WE HAVE ANSWERS.
Is this about writing the plan, or about running the response?
Writing the plan: the decisions, the chapters, the templates, approval and upkeep. Testing it and running exercises is covered in our separate course, OT Incident Drills and Exercises.
Will the plan fit my site if it's not a water plant or a utility?
Yes. The demo site is a water plant and the capstone is an electric cooperative, but every worksheet is built for any industrial site: manufacturing, energy, water, oil and gas or buildings.
Does it cover regulations?
It shows what the rulebooks ask an incident response plan to say in the US, the EU, Canada and Australia, and how to map your plan to the rules that apply to you. Rules change, so the course also shows where to check the current version.
Will finishing it make my site compliant?
No course can. Compliance is judged on your whole program. The course gives you a plan built to stand up in review, and an annex that shows reviewers where each requirement is met.
What files do I get?
Word, Excel and PDF files: the plan template, more than 40 templates, worksheets and checklists, 21 worked examples, and the full capstone package with a model answer.
How long does it take?
You work at your own pace. Most people write one chapter at a time, alongside their day job, and come back to each section as their plan develops.
What if it's not for me?
You're covered by our 30-day money-back guarantee. If you've completed half of the course or less, write to us through the Contact page within 30 days and we refund you in full.
Is there a subscription?
No. One payment of $147, with no subscription and nothing to cancel.