A manual operations drill tests whether operators can keep a physical process safe when networked control is unavailable. CISA's May 2025 mitigations list this ability alongside tested backups, standby systems and continuity plans. Run one by picking a scenario, involving operators and engineers, setting safety limits, timing each step and writing down what failed.
Why drill at all
Ransomware, an intruder or a bad update can force you to disconnect parts of a network. In the 2015 Ukraine incident, CISA's alert describes attackers wiping systems and disabling devices to slow restoration, and it advises developing and exercising contingency plans for operating or shutting down processes safely if the control system is breached.
A plan on paper says little. A drill tells you whether the manual valve is reachable, the log sheets exist, and anyone on shift remembers the procedure.
Plan the drill
- Choose a scenario. For example: the HMIs are unavailable for four hours. Or: the control network is isolated and only local panels work.
- Set the safety envelope with engineering. Decide what must not happen and what the stop conditions are. A drill must never create a real hazard.
- Pick a window with low process risk and notify everyone who could be confused, including neighbors and regulators if needed.
- Assign roles: an observer with a clock, a safety lead who can stop the drill, and operators who act.
- List what you expect to use: paper procedures, handheld radios, local gauges, spare keys.
Run it
Walk through the scenario step by step. Time how long each manual action takes. Note every place where someone says "I think it is in the drawer." Resist helping. The point is to see what happens without help.
Review it
Hold a short session soon after. Ask what was slower than expected, which tasks relied on one person, and which equipment was missing or locked. Turn each answer into an action with an owner and a date.
Also test the backup side, as CISA's guidance suggests: restore a controller configuration to a spare device, check how long it takes, and confirm the backup was current.
Make it routine
Repeat at least yearly, and after major changes. Rotate who participates so knowledge spreads. Keep the paper procedures printed and stored where operators can reach them without a network.
Scenarios worth trying
- The HMIs and historian are unavailable, but local panels work.
- The control network is isolated from the office network, and nobody can reach a vendor.
- A controller must be replaced and its logic restored from backup.
- The usual shift lead is absent, and a newer operator must follow the written procedure.
Start with the simplest, and add difficulty only after the team handles it calmly.
Quick check
Does a drill mean shutting the plant down?
Not necessarily. Many drills can be done as a walkthrough or in a simulated scenario. Agree the safety envelope with engineering first.
Who should lead it?
Operations, with security and engineering in support. Operators know the process best.
Safeguard's compliance and evidence automation can help you keep dated records of exercises and reviews for audits. It does not run drills for you.
Sources
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, IR-ALERT-H-16-056-01
Last reviewed: 19 October 2026.
