TREN
Schedule a MeetingSchedule a Meeting

OT and ICS Security

OT Incident Response Exercise

We conduct a tabletop exercise to rehearse how production is safely stopped and restarted in a controlled manner during a cyber incident. Operations, maintenance and IT teams participate together in one scenario.

Schedule a MeetingAll services in this area

What it is

OT incident response differs from corporate IT response. Here, the priority is process safety and production continuity, not data. The exercise tests who makes decisions and in what order, using a realistic scenario. The steps to stop and restart production are rehearsed.

Scope

  • Preparing a realistic incident scenario tailored to your sector and plant
  • Tabletop exercise with operations, maintenance and IT teams participating together
  • Rehearsal of decisions to stop production safely and restart it in a controlled way
  • Testing roles for authority, communication and notification to external authorities
  • Reporting gaps and improvements after the exercise

The need

When organizations need it

  • When OT and IT teams lack a shared plan for roles during an incident.
  • When a new control system is going live and the response process must also be ready.
  • When a past incident revealed gaps in decision coordination.

Method

How we work

  1. Scenario

    We build a scenario for your plant based on documented adversary behaviors. We refer to MITRE ATT&CK for ICS tactics.

  2. Exercise

    We bring the teams together at a table, run the scenario step by step and observe the decisions.

  3. Review

    We report the order of decisions, communication and gaps, and propose concrete improvements.

Outcome

What you have at the end

A response flow where the decisions to stop and restart production safely are rehearsed, and a concrete list of improvements for coordination gaps between teams.

Frequently asked questions

Is the exercise conducted on live systems?

No. A tabletop exercise is discussion-based. No live systems are touched and production is not affected.

Is there a NIST guide for this?

For OT security, NIST SP 800-82 Revision 3 is a reference. For response planning, we refer to the principles of NIST SP 800-61.

OT and ICS Security

Other services in this area

Let's talk about this service.

Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.

Schedule a Meeting