Illustrative example
HypotheticalA tabletop exercise reveals that the night shift would wait for IT before isolating a suspicious HMI. The procedure is updated so the shift supervisor can isolate within agreed limits, and the step is practised.
“If something happened on the plant network tonight, nobody's sure who decides what.”
Be ready to respond before an OT incident happens
OT incident response differs from IT: isolating a network or shutting down a process is an operational decision. Readiness means those decisions, contacts and backups are settled in advance.
Why it matters
Speed
Hesitation over who decides costs time during an incident.
Safety
Response actions must not create new hazards.
Reporting
NIS2 and similar laws set tight notification deadlines.
Recovery
Untested backups often fail when needed.
A structured approach
A sequence that can be adapted to your environment and scope.
Define
Agree decision rights for isolation and shutdown.
Prepare
Confirm contacts, vendors and reporting duties.
Back up
Verify offline backups of critical systems.
Exercise
Run a tabletop exercise with operations and IT.
Improve
Fix gaps found in the exercise.
What you end up with
- An OT incident response procedure
- Decision and contact matrix
- Tested restore records
- Exercise findings and actions
Frequently asked questions
How quickly must OT incidents be reported under NIS2?
NIS2 sets an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. National laws implement the details.
Related pages
From the blog
Latest OT security insights
-
Regulation7 min
NIS2 in 2026: what OT operators should have in place now
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the article -
Regulation6 min
The Cyber Resilience Act's reporting duties are live: what changes for OT
Manufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the article -
Architecture8 min
Zones and conduits in practice: segmentation that survives reality
Segmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the article
Facing this situation?
Describe where you are today and we'll suggest a practical way forward.