Why ICS Incident Response Is Not IT Incident Response
In IT incident response, the primary objectives are confidentiality and data integrity — contain the breach, eradicate the malware, restore systems from backup. In OT/ICS incident response, there is a third dimension that overrides the others: process safety and continuity. Taking a compromised PLC offline to image it for forensic analysis may be the correct IR action — but if that PLC controls a cooling pump for a reactor, taking it offline without a manual override in place could cause a physical safety incident. Every IR decision in an OT environment must be evaluated against its operational and safety consequence, not just its security merit. This requires ICS IR teams to include operations engineers and process safety experts, not just cybersecurity analysts.