A guide to preparing for OT cyber incidents while protecting safety, restoring operations and coordinating the people who run critical systems.
Published: 22 August 2026 | Last reviewed: 11 September 2026 | 8 min read
OT cyber incidents can affect more than data or business systems. They can disrupt production, damage equipment, affect safety, interrupt essential services and create environmental consequences.
An effective OT incident response plan prepares organisations to make safe, informed decisions under pressure. It defines who is involved, what systems and processes are prioritised, how threats can be contained and how recovery can occur without creating further risk.
The plan should bring together operations, engineering, maintenance, IT, cyber security, vendors and leadership. It should be based on the physical process and operating conditions, not applied as a generic IT playbook.
IT incident response often focuses on containing a threat, protecting information systems and restoring business services. Those actions remain important in OT, but they must be balanced against safety, process stability, equipment condition and operational continuity.
Immediately isolating a compromised system may be appropriate in an IT environment. In OT, that action could interrupt visibility, control or communications needed to operate safely. The right response depends on the affected process, its current operating state, the safeguards available and the consequences of disruption.
OT incident response must therefore bring together operations, engineering, maintenance and cyber teams. The first priority is to understand what action can be taken safely; technical containment should support that decision, not override it.
An OT incident response plan should help teams act quickly without losing sight of safety, process stability and operational continuity.
Prioritise the safety of people, the environment, physical equipment and the process being operated.
Identify the operating conditions, safe states and escalation points that guide decisions during a disruption.
Limit the spread or impact of cyber activity without interrupting essential monitoring, control or safety functions.
Bring operations, engineering, maintenance, cyber teams, vendors and leadership together around clear responsibilities.
Restore systems, configurations and operations according to defined recovery priorities and safe return-to-service conditions.
Capture lessons, update plans and strengthen controls after incidents, exercises and near misses.
An OT incident response plan should begin with an understanding of the operation. Before an event occurs, identify the processes that must remain safe, the systems that support those processes, the people who can make operational decisions and the conditions that would require a shutdown, manual operation or escalation.
This context helps responders distinguish between a cyber event that can be contained with limited disruption and one that requires immediate operational action. It also helps them understand which systems, communications and dependencies must be protected or restored first.
An OT cyber security risk assessment can help identify credible cyber scenarios, operational consequences and priority systems before an incident occurs.
During an incident, uncertainty over responsibility can delay action or create conflicting decisions. Your plan should make decision rights clear before an event occurs.
Teams should know who can assess process conditions, authorise isolation or shutdown, suspend remote access, approve configuration changes, direct recovery actions and manage external escalation.
Typical participants include an operations lead, engineering lead, maintenance lead, cyber security or IT lead, incident coordinator, executive sponsor and relevant vendors or service providers. The exact roles will vary by organisation, but each person should understand their authority, responsibilities and escalation path.
Assesses process conditions and determines immediate operational priorities.
Advises on control-system behaviour, safe states and technical recovery requirements.
Coordinates equipment checks, field work and controlled restoration activities.
Investigates activity, coordinates technical containment and preserves evidence.
Coordinates communications, decisions, actions and escalation across the response.
Provide specialist support through approved access arrangements and agreed escalation paths.
A single incident response document is rarely enough during a complex event. Support the main plan with short, role-specific playbooks for scenarios that are credible in your environment.
Each playbook should identify immediate safety checks, decision-makers, key contacts, isolation options, evidence to preserve, recovery dependencies and the conditions required to return to normal operations.
Relevant playbooks may include:
For scenarios involving vendors, jump hosts or remote support services, the Secure Remote Access for OT guide provides further practical guidance on controlling and suspending access.
Containment means limiting the spread or impact of an incident. In OT, this may include disabling remote access, isolating a network segment, blocking a vendor account, restricting traffic or moving a process to a safe operating state.
However, containment actions can also affect monitoring, control and safety. Before acting, responders should understand what systems may be affected, what visibility could be lost, what alternative operating methods are available and who is authorised to make the decision.
OT network segmentation supports safer containment by creating defined boundaries between systems and reducing the number of assets affected by a compromise.
Recovery should be planned before an incident, not improvised during one. Teams need to know which systems must be restored first, which dependencies must be available and how to confirm that a system is safe to return to service.
Recovery may involve restoring server images, rebuilding engineering workstations, validating control logic, re-establishing communications, re-enabling remote access or returning a process from a manual or safe state to normal operation.
Your OT asset inventory should identify the critical systems, ownership, dependencies, support arrangements and recovery information responders need when time is limited.
A plan that has never been exercised may not work as expected under pressure. Exercises help teams test assumptions, decision rights, communication channels, access arrangements and recovery steps before they are needed in a real incident.
Start with a tabletop exercise involving operations, engineering, maintenance and cyber teams. Use a realistic scenario, such as a compromised vendor account, loss of SCADA visibility or suspected malware on an engineering workstation.
Use the exercise to identify missing information, unclear responsibilities, technical constraints and decisions that need further preparation. Update the plan, playbooks and supporting records after each exercise.
Regular OT cyber security maintenance helps ensure response arrangements, access controls, backups and recovery information remain current as the environment changes.
Use these questions to assess whether your current approach is ready to support safe, coordinated OT incident response.
Use the answers to prioritise the next improvements. Start with gaps that could delay a safety-critical decision, prevent effective containment or make recovery uncertain.
Australian industrial and critical-infrastructure organisations should ensure incident response planning aligns with operational obligations, reporting responsibilities and the services they provide.
The ACSC provides guidance and assistance for organisations responding to cyber incidents, while relevant sector, contractual and regulatory obligations may require specific notification or escalation processes. Identify these requirements in advance, together with current contact details and decision authorities.
AS IEC 62443 also provides useful guidance for OT lifecycle security, including incident response, recovery, change management and supplier responsibilities.
Implicit OT helps industrial and critical-infrastructure organisations develop OT incident response plans, clarify decision roles, prepare practical playbooks and test recovery arrangements around the realities of their operations.
