Prepare the people before the incident.

Connect cyber response to operational authority

Cybersecurity staff may recognise an event without having authority to stop a process. Operators may observe an unsafe or unexplained state before the security team sees a useful alert. Document who owns each decision and how these teams reach one another. Align the cyber response with the organisation’s established safety and emergency procedures.

Prepare a usable contact route

Keep role-based escalation details, supplier support arrangements and an alternative communications method. Verify how the team can obtain them when the normal corporate environment is unavailable. Store sensitive contact and architecture information in the organisation’s approved systems, not in this public website.

Exercise one bounded scenario

Illustrative tabletop: a supplier reports that a maintenance account may be compromised. Ask the team to describe how it confirms the report, identifies the affected access, involves operations, records decisions and preserves useful evidence. Discuss an approved way to restrict access while protecting safe operation. A tabletop is a discussion exercise; it is not permission to interrupt production.

1. Define the system, participants, objectives and exercise boundary.
2. Introduce the scenario and ask each role to explain its next decision.
3. Record missing information, unclear authority and communication gaps.
4. Assign improvement actions, owners and a date for a follow-up review.

Specify recovery evidence

Identify the configurations, project files, known-good software, qualified personnel and support agreements required for recovery. Plan verification of the physical process as well as the computing environment. Recovery must be coordinated with responsible engineering and operational staff; a server starting successfully does not establish that an industrial process is ready to resume.

Learn without turning the exercise into a score

Record concrete observations: a missing escalation number, an unavailable restore package or disagreement over who approves isolation. Turn each into an owned action. The number of checked boxes in a workbook is not a measure of an organisation’s security or a compliance attestation.

Use the local workbook for discussion notes. The OTCSA team-skills paper explains why operational understanding and communication belong beside technical expertise.