Resilience · Operating Model
OT Incident-Response Operating Model
A coordinated response model linking SOC detection, incident command, plant operations, engineering authority, containment, continuity and safe restoration.
SECUREPLANE REFERENCE MODELOT Incident-Response Operating Model
Safety · mission continuity · evidence
01DETECTSOC · OT signals
02ASSESSprocess consequence
03DECIDEincident · operations
04CONTAINsafe action
05RESTOREengineering accept
Clear authority · communications · lessons
How should cyber response change when an action that contains risk may also interrupt a physical process?
Representative outputs
Artifacts that make the decision usable
No diagram is a deployable design until it is adapted to the environment, evidence, owners, and operating constraints.
OT response modelDecision matrixPlaybooksCommunications modelExercise and evidence plan