implementing-ot-incident-response-playbook

name	implementing-ot-incident-response-playbook
description	Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","incident-response","playbook","sans","iec62443","nist","safety-critical"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]

Implementing OT Incident Response Playbook

When to Use

• When building OT-specific incident response procedures for the first time
• When existing IT IR playbooks do not address ICS/SCADA-specific requirements
• When preparing for OT ransomware scenarios like EKANS or LockerGoga
• When aligning IR procedures with IEC 62443 and NERC CIP incident reporting requirements
• When conducting post-incident reviews to improve OT IR capabilities

Do not use for IT-only incident response without OT components (use standard NIST 800-61 playbooks), for day-to-day OT security monitoring (see implementing-dragos-platform-for-ot-monitoring), or for tabletop exercise design (see performing-ics-tabletop-exercise).

Common Misconfigurations & Verification

• Treating PLCs like Windows hosts. The most damaging IR mistake is powering off or "isolating" running PLCs to contain ransomware — PLCs run firmware, not Windows, and shutting them down disrupts the physical process. Containment isolates the IT/OT conduits at the DMZ, not field controllers; verify the playbook says so explicitly.
• No out-of-band comms or offline backups. If the IR plan depends on the same IT network the incident compromised, coordination fails. Confirm out-of-band channels exist and that verified offline PLC/HMI/historian backups exist and restore-test them.
• SIS branch missing from the playbook. A separate SAFETY/SIS path (engage process safety, verify physical barriers, never assume false positive) must exist, per TRITON/TRISIS lessons.
• Reporting clocks not wired in. CIRCIA 72-hour, NERC 1-hour BES, and sector ISAC timelines are easy to miss under pressure.
• Verify without disrupting the process. Validate the playbook through a tabletop and a non-production restore drill — exercise conduit isolation and backup restoration in a lab, never by severing live IT/OT links or shutting controllers on a running plant.

Prerequisites

• OT asset inventory with criticality ratings and safety system identification
• Defined roles: OT IR Lead, IT SOC Analyst, Plant Operations Manager, Process Safety Engineer
• Communication plan including out-of-band channels (OT incidents may compromise IT communications)
• Known-good backups of PLC programs, HMI configurations, and historian data
• Contact information for ICS vendors, Dragos/Claroty support, and CISA ICS-CERT

Workflow

Step 1: Define OT-Specific Incident Classification and Response Procedures

#!/usr/bin/env python3


 json
 sys
 datetime  datetime
 enum  Enum
 typing  , , 


 ():
    SEV1_SAFETY =   
    SEV2_PROCESS =   
    SEV3_ACCESS =   
    SEV4_RECON =   
    SEV5_IT_SPILLOVER =   


 ():
    RANSOMWARE = 
    MALWARE_ICS = 
    UNAUTHORIZED_ACCESS = 
    PROCESS_MANIPULATION = 
    SIS_COMPROMISE = 
    DATA_EXFILTRATION = 
    SUPPLY_CHAIN = 
    INSIDER_THREAT = 



PICERL_PHASES = {
    : {
        : ,
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
    },
    : {
        : ,
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
    },
    : {
        : ,
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
    },
    : {
        : ,
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
    },
    : {
        : ,
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
    },
    : {
        : ,
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
    },
}


 :
    

     ():
        . = 
        .title = title
        .severity = severity
        .category = category
        .affected_systems = affected_systems
        .created = datetime.now().isoformat()
        .current_phase = 
        .timeline = []
        .decisions = []
        .containment_actions = []

     ():
        
        entry = {
            : datetime.now().isoformat(),
            : phase,
            : action,
            : actor,
            : notes,
        }
        .timeline.append(entry)
         entry

     ():
        
        entry = {
            : datetime.now().isoformat(),
            : decision,
            : rationale,
            : approved_by,
        }
        .decisions.append(entry)
         entry


 :
    

     ():
        .playbooks = ._build_playbooks()

     () -> :
        
         {
            OTIncidentCategory.RANSOMWARE: {
                : ,
                : ,
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : [
                    ,
                    ,
                    ,
                ],
            },
            OTIncidentCategory.SIS_COMPROMISE: {
                : ,
                : ,
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : [
                    ,
                    ,
                    ,
                    ,
                ],
                : [
                    ,
                    ,
                    ,
                ],
            },
        }

     ():
        
        playbook = .playbooks.get(incident.category)
          playbook:
            ()
            

        ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()

        ()
         i, action  (playbook[], ):
            ()

        ()
         i, step  (playbook[], ):
            ()

        ()
         item  playbook[]:
            ()

        ()
         req  playbook[]:
            ()

        
        ()
         phase, info  PICERL_PHASES.items():
            ()
             item  info[][:]:
                ()


 __name__ == :
    engine = OTPlaybookEngine()

    
    incident = OTIncident(
        title=,
        severity=OTIncidentSeverity.SEV2_PROCESS,
        category=OTIncidentCategory.RANSOMWARE,
        affected_systems=[, , , ],
    )

    engine.execute_playbook(incident)