Skip to content
NelnationaleConsulting

Industrial & OT Technology

OT Incident Readiness

OT-specific playbooks, tabletop exercises and recovery planning that account for safety systems.

Overview

Corporate incident response plans assume you can isolate a machine and rebuild it. On a plant, isolating the wrong device stops production or trips a safety system.

We write playbooks for the environment as it actually is, then run the exercises that find out whether they work before an incident does.

What is included

  • OT-specific incident response playbooks
  • Roles, escalation and decision authority in an upset
  • Safety system considerations and isolation constraints
  • Tabletop exercises with operations and IT together
  • Backup and recovery validation for control assets
  • Golden image and configuration management
  • Communications plan for regulators and stakeholders
  • Post-incident review process

How we run it

  1. 01

    Scope

    Map plausible scenarios against the site's real dependencies and safety constraints.

  2. 02

    Build

    Write playbooks with named roles and explicit decision authority.

  3. 03

    Launch

    Run tabletops with both teams in the room, and rewrite what fails.

  4. 04

    Measure

    Validate backups by restoring, then set the exercise cadence.

Questions

Before you enquire

Who should attend the tabletop?
Operations, IT, HSE and a decision maker with authority to stop production. Without that last person the exercise is theatre.
How often should we exercise?
At least annually, and after any significant architecture or personnel change.
Do you support live incidents?
Retainer clients get response support. We are explicit that having a plan beforehand matters more than our phone number.

Often bought together

ICS & SCADA Security Assessment

Passive asset discovery, vulnerability triage and a ranked, costed remediation roadmap.

OT/IT Convergence Architecture

Purdue-model zoning, DMZ design, segmentation and secure remote access for live plant networks.

Enterprise Cyber Security

Identity, endpoint, cloud posture and audit readiness for ISO 27001 and SOC 2.

Next step

Need ot incident readiness?

Tell us what you are trying to achieve and by when. We will come back with scope, price and an honest view on fit.

Book a consultation