Historian Ransomware OT Lab
Ransomware encrypts the corporate network overnight, then the plant historian and an engineering workstation. The process is still running. Make eight to ten scored decisions with operations: shut down or run manually, cut the IT/OT link, protect the evidence, check the controllers safely, restore and reconnect.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Ransomware hits Riverside Foods's corporate network overnight and spreads to the plant historian and an engineering workstation at Northgate bottling plant. The process is still running. You lead the security response alongside operations: decide who stops what, whether to cut the IT/OT link, how to run without the historian, how to check the controllers without breaking them, and how to restore and reconnect. Choices change the story.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- A realistic overnight timeline: file servers encrypted at 02:40, the historian at 02:51, a ransom note on the engineering workstation at 02:53, the process still running.
- Choices branch: an emergency shutdown costs product and an 18-hour restart; an active scan of the control network faults an older PLC and stops the line.
- Teaches the OT order of priorities: safety and the authority over the process first, containment at the IT/OT boundary, evidence without touching controllers, restore from known-good.
- Rename the organisation, plant and process so the debrief you export fits your site.
Frequently asked questions
Should a plant shut down when ransomware hits the IT network?
Not automatically. If the controllers and safety systems are unaffected and the IT/OT boundary can be cut, many plants keep running in a controlled or manual mode. The decision belongs to operations and the people responsible for process safety, based on whether the process can be run and monitored safely without the systems that were lost.
Why does ransomware on the historian matter?
The historian usually sits between the plant and the business, so it is often the path ransomware takes toward OT. Losing it means operators lose trends and the business loses batch and quality records, which can matter for regulators. Most data collectors buffer values locally for a while, which gives you a window to rebuild and backfill.
How do you check whether PLC logic was changed?
Use the vendor's engineering software on a clean machine to read the running logic in compare mode and diff it against a known-good offline copy, with the control engineer present. Do not use a possibly compromised engineering workstation, and do not reload logic onto running controllers without a planned change.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.