Course Description
When an industrial system is compromised, the standard IT playbook — isolate, image, wipe, restore — can be exactly the wrong thing to do. Pulling a controller offline may create a safety hazard; wiping a system may destroy the only evidence; and the priority is not confidentiality but keeping the process safe and running.
This course develops incident response capability specific to industrial environments. Participants learn OT incident response planning, the safety-first decision framework, evidence collection from control systems, industrial forensics constraints, containment strategies that do not endanger the process, recovery and restoration, and how OT response integrates with plant emergency management.
What you will achieve
By the end of this training course, participants will be able to:
- Explain how OT incident response differs from IT
- Build an OT incident response plan
- Apply a safety-first response framework
- Detect and triage industrial incidents
- Collect evidence from control systems safely
- Understand industrial forensics constraints
- Apply containment that protects the process
- Manage recovery, restoration and lessons learned
How the course is delivered
The course combines OT incident response methodology with tabletop exercises based on realistic industrial incidents. Participants work through detection, triage, containment and recovery decisions under safety constraints.
The programme emphasises that in OT the priority is process safety and availability, which reverses much standard IT response practice.
Designed for
This training course is ideal for:
- OT and control system engineers
- Incident responders supporting industrial sites
- Industrial cybersecurity professionals
- Operations and plant managers
- Anyone responsible for OT incident response
Daily programme
- Why OT response differs from IT
- Safety first: the decision framework
- Building an OT incident response plan
- Roles, escalation and communication
- Detecting industrial incidents
- Triage and impact assessment
- Safe evidence collection from control systems
- Industrial forensics constraints
- Containment without endangering the process
- Recovery and restoration
- Integration with plant emergency management
- Tabletop exercise and review
Certification & accreditation
BII Certificate of Completion
BII Certificate of Completion Upon successful completion, participants receive a BII Development Institute Certificate of Completion with a unique reference code that is independently verifiable. Our certificates are recognised internationally and reflect successful completion of your chosen programme.
