ICS like this is well already well developed for dealing with cyber incidents, e.g. malware incursion or data exfiltration. A really well thought through exampl

ICS like this is well already well developed for dealing with cyber incidents, e.g. malware incursion or data exfiltration. A really well thought through example is the NIST cyber security framework [0], which defines a cyber defensive lifecycle (identify, protect, detect, respond and recover). At least in the UK, this lifecycle has been adopted by Critical National Infrastructure (CNI) organisations such as electricity generation, transmission and distribution. The key to successful incident response is to design, agree and test the ICS processes, roles and Command and Control (C2) hierarchies before incidents occur, capturing the results in an Incident Response Plan. The IRP will typically involve standing up an incident response team when an incident reaches a pre-defined severity level. Incident response teams are often structured into bronze, silver and gold levels of command (gold typically including Cxx individuals such as CIO and CFO, not just DevOps roles) that temporarily replace Business as Usual (BAU) management with incident C2. In the UK at least, the bronze/silver/gold hierarchy was developed by the ‘blue-light’ services (police, fire and ambulance), and is itself a simplified version of military C2 chains of command. If management don't buy into this type of approach, it doesn't node well for an organisation's ability to deal with a crisis. [0] https://www.nist.gov/cyberframework https://www.nist.gov/cyberframework