All tabletop exercises
OT / ICS·Advanced·Executive audience
Shut the plant or keep running? Costing an OT security decision
The prompt — read this to the room
Your food-packaging plant runs three shifts and produces about $95,000 of product an hour. At 10:00 the SOC confirms ransomware on the corporate network and finds the same malware on one engineering workstation that can reach the lines' controllers. The lines are running normally. Isolating the plant network means losing the production schedule and batch records held in IT systems and running on paper at reduced output. A full shutdown is safest and costs more every hour. A major customer's promotion depends on next week's shipments. The board chair wants options and numbers by 13:00.
Total duration
2 h 15 min
People to involve
7
Best fit
Manufacturing
Who to involve
Most important first.
- CEO / Managing director
- CFO / Finance
- OT / plant engineer
- CISO / Head of security
- CIO / CTO
- Legal counsel
- Board member
What it tests
- Build three costed options (run isolated, reduced output, full shutdown) with safety and food-quality conditions
- Define the evidence that would trigger a move from one option to another
- Bring insurance, customer contracts and food-safety record duties into the decision
- Present a board-ready recommendation with explicit risk acceptance
Outline of activities
- 1Ransomware in IT, one foot in OT
- 2What the plant can actually do on its own
- 3Costing the three options
- 4Triggers, insurance and contracts
- 5Board briefing and recommendation
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…