Cybersecurity
Incident Response
Planning for the day it happens.
Written guides in this section
Full references, procedures, and diagnostic guides published under Incident Response.
OT Incident Response Plan
The plan for the day the control system is not trusted: who decides, the triggers, the first hour, isolating without stopping treatment, running by hand, preserving evidence, who to notify and when, recovery from backups, and the exercise that makes it real.
10 min readUpdated Sep 5, 2026
Isolating a Compromised System
Cutting a compromised machine, segment, or site off from the control system without stopping the process: who may decide, isolation points planned in advance, disconnecting the network rather than the power, running on manual control, and preserving evidence.
9 min readUpdated Sep 5, 2026
Manual Operation Procedures
Written procedures for running the plant and the remote sites without the SCADA or the controllers: what to read and set by hand, how often to check, what to log, chemical dosing from a flow reading, when to stop, staffing, and the drill that proves them.
9 min readUpdated Sep 5, 2026
Recovery and Restoration
Bringing a control system back after a compromise without reintroducing it: controllers verified against baselines first, servers rebuilt from clean media and project exports, every credential changed, hardening, staged reconnection, and end-to-end tests.
9 min readUpdated Sep 5, 2026
Reporting Requirements
Who a water or wastewater utility must tell about a cyber incident, how fast, and what to say: the federal critical infrastructure reporting rule, state laws, the drinking water regulator, public notification, law enforcement, the sector center, and insurers.
9 min readUpdated Sep 5, 2026
Topics in this area
OT Incident Response Plan
OT Incident Response Plan — practical reference notes for controls engineers, integrators, and technicians working with incident response.
Isolating A Compromised System
Isolating A Compromised System — practical reference notes for controls engineers, integrators, and technicians working with incident response.
Manual Operation Procedures
Manual Operation Procedures — practical reference notes for controls engineers, integrators, and technicians working with incident response.
Recovery And Restoration
Recovery And Restoration — practical reference notes for controls engineers, integrators, and technicians working with incident response.
Reporting Requirements
Reporting Requirements — practical reference notes for controls engineers, integrators, and technicians working with incident response.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.
References to manufacturers, products, model numbers, software platforms, technical specifications, companies, standards organizations, or other organizations are provided for informational purposes and do not imply sponsorship, endorsement, authorization, or affiliation unless expressly stated. Manufacturer specifications must be independently verified against current manufacturer documentation.