To run a manual operation drill, pick one process, list the IT and OT systems it depends on, simulate losing them, run the process using the manual procedures, and record what slowed you down. CISA lists practising manual operation among its five primary OT mitigations.
Why it is on the shortlist
The May 2025 joint guidance says the ability to operate manually is vital for restoring operations quickly after an incident, and asks owners to regularly test business continuity and disaster recovery plans, fail safe mechanisms, islanding capabilities, software backups and standby systems. The Volt Typhoon and DarkSide advisories repeat the point: identify IT and OT interdependencies, develop workarounds, and test manual controls.
Before the drill
- Choose a scope. One line, one unit or one site area. Start small.
- Map dependencies. For that process, list what it needs: identity services, time, historian, recipes, licences, remote support.
- Write the manual procedure. If one does not exist, writing it is the first finding.
- Name roles. Who decides to isolate, who runs the process, who talks to management.
- Set stop conditions. Agree in advance what ends the drill if safety is in doubt.
Running it
- Start in a planned window with operations leadership present.
- Simulate the loss, for example by treating the supervisory system as unavailable.
- Keep the real safety systems and procedures in place throughout. The drill tests manual control, not removal of protections.
- Use only the written procedure. When someone improvises, note it.
- Time key steps, such as isolating networks and restarting from backups.
After the drill
Hold a short review the same day:
- What was missing from the procedure?
- Which dependency surprised you?
- Could the crew hold this for hours, not minutes?
- Were backups of controller logic available and current?
- What decisions waited for someone not in the room?
Turn answers into tracked actions with owners and dates. Repeat on a schedule, and rotate the process you test.
Link it to isolation
The agencies also stress the ability to isolate ICS networks. Include a step in the drill where you cut the IT to OT conduit and confirm that operations continue on the local network.
Keep the findings visible
Share a one page summary with operations, IT and management after each drill. When leadership sees that a missing printed procedure delayed recovery, funding for fixes tends to follow more easily than it does for abstract risk.
Quick check
Does a drill mean switching off safety systems?
No. Safety systems stay active. The drill tests running the process without supervisory or IT services.
How often should we run one?
CISA says to test regularly without giving a fixed interval. Choose one your operations team can sustain and run it at least after major changes.
Sources
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, DarkSide Ransomware advisory AA21-131A
- CISA, Volt Typhoon advisory AA24-038A
Last reviewed: 19 October 2026.
