Certified Information Security Manager (CISM)Incident ManagementMedium
A global manufacturing company experiences a significant cyber-physical incident that affects its operational technology (OT) systems, leading to production downtime across multiple facilities. The CISO is tasked with ensuring a comprehensive recovery. Beyond restoring IT systems, which of the following is the MOST critical consideration for incident recovery in this OT environment?
- AVerifying the integrity of all IT financial transaction logs.
- BPrioritizing the restoration of corporate email and collaboration tools.
- CEnsuring the safety and functionality of industrial control processes.
- DExpediting communication with external legal counsel regarding data breach notification.
Show answer & explanationAnswer & explanation
Correct answer: C. Ensuring the safety and functionality of industrial control processes.
In an OT environment, the primary concern for incident recovery, especially after a cyber-physical incident, is ensuring the safety and correct functionality of industrial control processes. Failures here can lead to physical harm, environmental damage, or severe operational disruption, far outweighing typical IT concerns.
Why the other options are wrong
- A. IT financial logs are important but secondary to immediate physical safety and operational integrity in an OT incident.
- B. Corporate IT services are important for business continuity but are typically not as critical as OT system functionality for an OT incident.
- D. Legal communication is important but comes after ensuring the immediate safety and functionality of critical OT systems.
OT Incident Recovery Priority
In an Operational Technology (OT) environment, incident recovery prioritizes the safety of personnel and equipment, environmental protection, and the restoration of physical process functionality over traditional IT concerns.
- Safety is paramount.
- Physical damage and environmental impact are major risks.
- RTOs for OT systems can be extremely short.
Memory trick: OT recovery: Safety first, then the factory hums.