OT Cyber Incident Response
The course distinguishes enterprise-IT response from industrial-control response. Participants exercise roles, notification criteria, evidence collection, containment decisions, crisis communication, and recovery in a tabletop scenario—without unsafe shutdown assumptions.
Learning objectives
- Develop OT-specific playbooks and escalation criteria
- Choose containment actions based on safety and operational impact
- Coordinate evidence, communications, and post-incident recovery
Who should attend
- CSIRT and SOC members
- Shift, operations, and HSE managers
- Security and business-continuity owners
Prerequisites
- Familiarity with the incident-response lifecycle
- General knowledge of industrial architecture and processes
Core course modules
- Incident Response Lifecycle