Incident response in OT environments: the critical differences from IT

Why IT IR does not work in OT

The first instinct of an IT incident response team faced with a compromised system is to isolate it: disconnect the system from the network, collect the evidence, analyze. In an IT environment this procedure is well established and generally safe.

In an OT environment, the same instinct can cause serious damage.

A PLC controlling a chemical dosing line cannot be "isolated from the network" without first understanding exactly what it is controlling and what the operational consequences of isolation are. A SCADA system managing pressure in a gas distribution network does not get shut down the way a mail server does.

The fundamental differences between IT IR and OT IR:

Different priorities: in IT, the priority is to protect data and restore services. In OT, the priority is the safety of people, then operational continuity, then data integrity. An action that protects data while creating a safety risk is not acceptable.

Systems that cannot be isolated: many OT systems cannot be powered off or isolated without immediate operational consequences. The response must take place with the system running.

Different time windows: IT incident response works in hours or days. An industrial plant might have maintenance windows available only weekly or monthly. Some remediation actions can be carried out only during these periods.

Different skills: standard forensics techniques (disk image acquisition, RAM memory analysis) apply poorly to PLCs and embedded OT devices, which have architectures and storage systems completely different from IT servers.

Triage in an operational environment: safety vs. response

The triage phase in an OT incident requires the joint participation of two functions that rarely work together: the information security team and the operations team.

The security team can identify what has been compromised, but often does not know the operational consequences of each response action. The operations team knows the plant but lacks the cyber incident response skills.

The critical decision in triage is: act immediately (with the risk of operational impact) or contain the spread of the incident while maintaining operations (with the risk of further compromise)?

There is no universal answer. It depends on:

• Which system is compromised and what it controls
• Whether the attacker is still active and carrying out malicious actions
• Whether there are signs of an imminent objective (e.g., a planned sabotage)
• Whether the plant can operate in manual mode in the meantime

These decisions must be made quickly, under pressure, with incomplete information. Preventive preparation, having already discussed these scenarios and having a shared decision-making framework, is what makes the difference.

The OT playbook: phases and key decisions

An effective OT playbook must adapt the standard IR structure to the peculiarities of the industrial environment:

Phase 1, Detection and notification: who must be notified immediately? Not just the CISO and the IT team: also the production manager, the safety manager, and senior management. In many cases, regulations (NIS2, DORA) require external notifications within 24 hours.

Phase 2, Initial OT risk assessment: before any technical action, answer: are there immediate safety risks? Can the compromised system be isolated without critical impact? What is the worst action the attacker could take?

Phase 3, Safe containment: define the possible containment actions that do not increase operational risk. Block specific network connections instead of fully isolating; increase monitoring instead of shutting down; switch critical functions to manual mode as a precaution.

Phase 4, Evidence collection: adapt acquisition techniques to the capabilities of OT systems. HMI logs, recorded network traffic, PLC configurations, SCADA system events. Document the time and conditions of each collection.

Phase 5, Planned remediation: define remediation actions with the operations team, schedule them within the available maintenance windows, and test each action in a test environment before applying it to the live plant whenever possible.

Forensics in industrial environments: constraints and techniques

Acquiring forensic evidence in OT environments presents specific challenges:

PLCs and embedded devices: they do not have filesystems accessible with standard forensic tools. The "memory" of a PLC is its control logic and the state of its registers. Acquisition requires platform-specific tools (Siemens Step 7, Rockwell Studio 5000, etc.) and expertise in the data format.

Systems that cannot be powered off: forensic acquisition of a live system (without powering it off) is always less accurate than offline acquisition. In many OT cases, it is the only option available.

Logs with limited retention: many OT systems keep logs in volatile memory with a retention of a few hours. Log collection must happen quickly so as not to lose evidence.

Chain of custody in industrial environments: maintaining forensic chain of custody in a plant where operational staff must keep working requires specific procedures that balance evidence integrity and operational continuity.

Tabletop exercises: how to prepare before the incident

Preparation for OT incident response cannot be purely theoretical. Tabletop exercises, simulated scenarios discussed as a group with no real technical interventions, are the most effective way to build operational readiness without risk to the plant.

An effective OT tabletop exercise:

Realistic scenario: not "an attacker enters the network" but "at 2:30 PM on Tuesday, the SCADA system of line 3 shows anomalous behavior: temperature setpoints are being changed without anyone having altered them". Specific, with real operational details.

Mixed participants: CISO, IT manager, production manager, process engineer, safety manager. The exercise serves to surface the gaps in communication between functions.

Hard decisions: deliberately include scenarios where there is no obvious answer. "Do we isolate the system and stop the line, or do we monitor and risk the attacker acting?": this discussion, held in advance in a non-emergency context, builds the ability to make fast decisions when it truly matters.

Structured debriefing: at the end, document the gaps identified and the improvement actions decided. An exercise without follow-up has limited value.

Organizations that run regular exercises respond better to real incidents. Not because they have seen exactly the same scenario, but because they have already gone through the decision-making process and know how to collaborate under pressure.

The MON5 angle

When the OT incident arrives, the difference is made by what was prepared beforehand: an up-to-date inventory, behavioral baselines, recorded network traffic. MON5 provides exactly this context: continuous asset inventory immediately tells you what the compromised system controls, while passive out-of-band NDR preserves network evidence without touching the devices, a decisive advantage where traditional forensics does not apply.

ML anomaly detection also shortens detection time, giving the team more room for containment decisions coordinated with Operations. Build your response readiness starting from an OT assessment.