The first hour of an OT cyber incident: a plant checklist

In the first hour of a suspected OT incident, protect people and process safety first, then decide whether to isolate networks, switch to manual operation, preserve logs and backups, and notify the right parties. Write this plan down before you need it, because nobody thinks clearly at 3 am.

Principles from the guidance

The Ukraine alert advises developing and exercising contingency plans for safely operating or shutting down processes if an ICS is breached, and performing impact analysis before taking defensive measures. The ransomware advisory describes a company that proactively disconnected certain OT systems for safety. These point the same way: safety and operational judgement come first, and security actions must be weighed against them.

Minutes 0 to 15: stabilise

1. Make sure the process is in a safe state. Operations leads this decision.
2. Name an incident lead and a scribe. Start a timeline.
3. Do not wipe, reboot or reimage affected systems yet, which would destroy evidence.
4. Note what was seen, by whom, and when.

Minutes 15 to 30: decide on isolation

• Is there evidence of spread between IT and OT? If so, consider cutting the conduit between them.
• Can the plant run safely on local control and manual procedures? CISA's primary mitigations call manual operation vital for restoring operations quickly after an incident.
• Close or restrict remote access paths, especially vendor and cellular links.
• Run an impact check before each defensive step, as the Ukraine alert advises.

Minutes 30 to 45: preserve and assess

• Preserve logs from firewalls, VPNs, jump hosts and engineering workstations. Copy them off the OT network.
• Confirm that backups of controller logic and configuration are intact and offline.
• Compare running controller logic with the gold copy if you can do so safely.
• List which accounts and remote paths were active.

Minutes 45 to 60: notify

• Inform plant management and your executive contact.
• Contact your integrators and vendors who may hold system specific guidance.
• Report to the authorities that apply to you. The Siemens S7 alert asks owners to report incidents to CISA, the FBI and the vendor's product security team. Check your own legal reporting duties, for example for critical infrastructure or EU rules.
• Brief your insurer or counsel if your plan says so.

What to prepare in advance

• Contact sheet for operations, IT, integrators, vendors and regulators.
• A one page decision tree for isolation.
• Offline copies of the plan, since email may be down.
• A rehearsal using a tabletop or the manual operation drill.

After the first hour

Keep a log of decisions, recover from known good baselines, rotate credentials that touched the affected zone, and hold a review. Feed the findings into your inventory, segmentation and drill plans.

Quick check

Sources

• CISA, Ukraine Power Grid Cyber-Attack alert IR-ALERT-H-16-056-01
• CISA, DarkSide Ransomware advisory AA21-131A
• CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
• CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A

Last reviewed: 19 October 2026.