Find out why your plan would fail its first real test, and choose a drill or an exercise for each gap.
OT Incident Drills and Exercises
Your OT incident response plan has never been run on the plant floor. Learn to design, run and prove the drills and tabletop exercises that test it, before an incident does.
US$47 one-time2.4 hours24 lessonsIntermediate
What you will learn
Check your plan for safe state, manual fallback and the warning signs operators see at each layer of the plant.
Design scenarios that escalate in layers, starting from the free CISA tabletop packages instead of a blank page.
Run an executive tabletop that tests who decides, and a technical tabletop that puts a clock on every playbook step.
Know what NERC CIP-008-6 and the TSA pipeline directives expect from a test, and turn every finding into an improvement plan with an owner and a date.
Plan twelve months of drills around the outages you already have, and prove on a bench that your backups can rebuild a working plant.
About the course
In December 2015, attackers took over the control screens at three Ukrainian power companies. About 225,000 customers lost power, and the attackers wiped the control room computers and flooded the phones. Crews drove to the substations and closed the breakers by hand, and most customers had power back within hours. That speed came from people who still knew how to run the grid without the screens. Would your team know what to do at your site tonight, with the screens dark?
If your plan has never been run on the plant floor, you are not alone. Most incident response guidance was written for IT, and the exercise that does happen is usually in a conference room. It never asks what you do when isolating a controller means stopping production, or who may make that call at three in the morning.
How long an OT incident lasts is decided before it starts, by whether your team has practised the response on the plant floor. You can build that practice with exercises you run yourself, not with a bigger budget. This course does it in three moves: design, run, prove.
You may think an exercise is just a meeting about the plan. Real incidents break several things at once, so your scenarios escalate in layers until the team reaches a decision it cannot avoid. You may think you need a red team. You need two sessions: an executive tabletop that tests who decides, and a technical tabletop that puts a clock on every step. And you may think operations will never give you downtime. Restores are drilled on a bench, never on the line, and the year of drills is planned around outages you already have.
You finish by preparing and running Exercise QUIET FEEDER, a full ransomware tabletop at a fictional electric cooperative, then compare your work with the model solution. You can run the same exercise with your own team every year. Two real incidents, the 2015 Ukraine grid attack and Norsk Hydro's 2019 ransomware response, are told from the responder's side.
There is no hands-on lab, no live PLC work, no malware analysis and no certificate. The course does not make anyone compliant; it helps you produce test records an auditor can check. This is an online, self-paced course delivered through HKSM Courses. No physical product is shipped.
Who this is for
- OT and ICS security leads who own an incident response plan that has never been run end to end
- Control systems engineers and control room supervisors who would be on shift when it is used
- Plant and operations managers in utilities, pipelines and manufacturing
- IT security teams whose exercises stop at the IT network and need to bring in the plant floor
- Compliance and risk staff preparing for CIP-008 tests or the TSA pipeline directives
Requirements
You should already know how an industrial site works: PLCs, HMIs, SCADA, and why OT differs from IT. This is not a course for complete beginners to industrial control systems. No prior experience of planning exercises is needed. You need an internet connection and a browser to access the online course.
Course outline
Your IRP Is Not a Tested Plan
Why a plan that has never been exercised gives false confidence.
Drills vs. Exercises - Two Different Tools
When to drill a single skill and when to exercise the whole team.
The OT Incident Response Lifecycle
The incident response lifecycle, adapted to operational technology.
Anatomy of an OT Incident Response Plan
The sections every OT incident response plan needs, and the gaps that hide in them.
Safe State and Manual Fallback
Defining safe states and manual fallback before you need them.
How Operators Detect Cyber Events
How operators notice cyber events, and what they should do next.
OT-Specific Indicators of Compromise
Indicators of compromise that are specific to industrial systems.
Executive Tabletop - Governance Under Pressure
Running a tabletop that tests leadership decisions under pressure.
Technical Tabletop - Prove Your Playbook
Running a technical tabletop that proves your playbooks work.
Building an Escalating OT Scenario
Building a scenario that escalates realistically, inject by inject.
Using the CISA CTEP Library
Using the CISA Tabletop Exercise Package (CTEP) library.
Five Scenario Types Every OT Team Must Drill
Five scenario types every OT team should practise.
The Communication Chain During an OT Incident
Who calls whom, by which channel, and within what time.
External Reporting Obligations - What You Must File and When
What you must report, to whom, and by when.
NERC CIP-008-6 - What the Standard Actually Requires
What NERC CIP-008-6 actually requires for response and testing.
TSA Pipeline Directives - What Changed After 2021
How the TSA pipeline security directives changed expectations after 2021.
The HSEEP AAR-IP - Turning Exercises into Improvements
Writing an After-Action Report and Improvement Plan that gets closed.
OT IR Maturity - C2M2, CMMC, and Metrics That Matter
Measuring maturity with C2M2, CMMC and practical metrics.
Recovery Readiness - The Backup You Can Actually Use
Making sure the backup you rely on can actually be restored.
The 12-Month Drill Cadence
Planning a year of drills and exercises that build on each other.
Ukraine Power Grid 2015 - When Every Response Tool Was Disabled
Case study: the 2015 Ukraine power grid attack.
Norsk Hydro - The Model OT Ransomware Response
Case study: how Norsk Hydro responded to ransomware.
Assignment: Run the Tabletop - Exercise QUIET FEEDER
Hands-on assignment: prepare and evaluate a three-module ransomware tabletop for a fictional electric cooperative, with a full model solution.
Final Word
Wrapping up, and where to take your program next.
What you get
- The course: Design, Run, Prove, from your first plan audit to a full year of drills
- Exercise QUIET FEEDER: a ransomware tabletop kit with the situation manual, the participant workbook and the model answers, ready to run with your own team
- Your year of drills on one page: the 12-month drill cadence template
- The control-room card: OT indicators of compromise at the controller, network, HMI and process layers
- The scenario design template, so your next exercise is already designed
- The plan audit kit: checklists and 69 questions that find the gaps before an auditor does
- The private course forum: ask the teacher your questions, and compare notes with other students running their own exercises
Your 30-day guarantee
For a paid HKSM Courses purchase, request a refund within 30 days of purchase if you have consumed 50% or less of the course, using the progress recorded by the platform when you request it. After a refund, access ends and you must delete the course materials and associated downloads and stop using them.
Read the Refund Policy and Terms and Policies. Questions? Contact HK School of Management and Technology.
Questions
Who is it not for?
Complete beginners to industrial control systems: learn how PLCs, HMIs and SCADA work first. It is not a forensics or malware course, and there is no lab work on live PLCs.
Can I really run QUIET FEEDER with my own team?
Yes, that is what it is built for. It is a full ransomware tabletop at a fictional electric cooperative, with everything the exercise lead and the players need, and model answers. You can run it again every year.
We are not a utility or a pipeline. Is it still useful?
Yes. The scenarios cover ransomware, HMI manipulation, vendor access, insider credential abuse and controller compromise, which apply to any plant. The NERC and TSA lectures are one part of the course, for teams that answer to those rules.
Will this make us NERC or TSA compliant?
No course can. Compliance is decided by auditors against your whole program. The course shows what NERC CIP-008-6 and the TSA pipeline directives expect from testing, and how to run exercises whose records can serve as test evidence.
Our plan has never been tested. Where do we start?
At the beginning. The course opens with why plans fail the first time they run, and has you check your plan before you design the first exercise.
Do I need special equipment?
Not for the tabletops: a room, the materials and the people who would actually respond. The restore drill uses a test bench built from your own equipment and backups.
What if I get stuck?
Post your question in the private course forum. The teacher answers there, and other students share how their own exercises went.
What if it is not for me?
Request a refund within 30 days of purchase if you have consumed 50% or less of the course. The full terms are in the Refund Policy.
Are there any additional costs?
No. One payment of US$47. No subscription and nothing to cancel.