ICS4ICS Exercise at ISA OT Cyber Security Submit - May 30, 2023 - Executive Summary - Detailed Recommendations

Sep 12, 2026

Upload by Ivy

An executive summary and recommendations document covering an ICS4ICS exercise facilitated by Mark Boddy on May 30, 2023, at the ISA OT Cyber Security Submit in Aberdeen, Scotland. It outlines participant-identified improvements spanning professional certification maintenance, disaster recovery and logistics planning, staffing alternative options, medical testing examples, injects for criminal investigation, and expanded, clearer training materials. It further includes hot-wash strengths, participant roles, and detailed process guidance for planning, forms, escalation, CIRT/SOC procedures, and BCP resources.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages3

Reading Time1 min

AccessFree to download

Executive Summary

Exercise Hot-Wash

Detailed Recommendations

1 ICS4ICS Exercise at ISA Cyber Security Submit on May 30, 2023 Executive Summary Mark Boddy facilitated an ICS4ICS Exercise on May 30, 2023, at the ISA OT Cyber Security Submit in Aberdeen Scottland. The exercise participants identified these recommendations: 􀁸 Consider issuing Continuing Professional Education (CPE) certificates that would allow exercise participants to maintain their professional certifications 􀁸 Develop an IT Disaster Recovery template that asset owners can use to identify options to restore network and other communications that may be impacted by the incident 􀁸 Update the exercise materials to explain the difference between a strike force and the other ICS4ICS sub-teams 􀁸 Document the need to manage the logistics challenges that the Logistics Section Chief must address to ensure that equipment and staff can be deployed to the appropriate locations; this may include the need for special transportation vehicles, fuel for the vehicles, and safety considerations (e.g., obtain government escort for transportation vehicles) 􀁸 Create a template to determine how an ICS4ICS team will ensure staff alternatives are identified including primary, secondary, and tertiary staffing along with external staffing options that maybe needed 􀁸 Post an example of how medical testing may be needed (e.g., COVID-19) 􀁸 Add INJECT to include a criminal investigation which should ensure that the Cyber team limit discussion about cyber issues with ICS4ICS team and do not communicate details in case it is an insider (e.g., the IC and a few people would be aware of the criminal details from the investigation) 􀁸 Add more industry specific ICS4ICS Exercises and use past attacks in each industry to create exercise drills and ask the question: Would my company survive this attack? ©2024 International Society of Automation 2 􀁸 Update exercise presentation deck: o Slide 77 (Form 204) with multiple sections – need to expand slide to it is easier to read o Slide 95 – speaker notes FASC asks “OSC please submit an ICS-213 Resource Request”but next slide has the OSC presenting the ICS-215 Operational Planning Worksheet – Add speaker notes to clarify the 213RR will be create after the current meeting o Slide 147 (Print IAP)– need to describe that IAP may be distributed electronically; Ensure that all parties who receive IAP are covered by an NDA (the NDA is normally part of a Mutual Aid Agreement o Add a slide at beginning of presentation to review a “glossary” of positions (e.g., IC, SOFR, OSC, etc.) 􀁸 Execute Plan & Assess Progress: Ensure to explain that the IAP is being developed for the next operational period; After an incident is declared and we are in the first operational period of an incident, tasks and actions will be taken to manage the incident during that first operational period; The IC/UC will determine if the Incident has been resolved or if another Operational Period is needed); Explain how the Planning P process ends when the incident ends at the direction of the IC/UC 􀁸 Ensure Escalation and CIRT procedures explain how the SOC is involved in these processes; Also, explain how the SIEM is used by the CIRT 􀁸 Create a resource that explains how BCP is used by the ICS4ICS process 􀁸 Continue efforts to engage smaller companies including existing effort with small water, wastewater, and other utilities to help them understand how ICS4ICS can help them manage incident and that it is FREE Exercise Hot-Wash Exercise Strengths identified in Hot-Wash 􀁸 Explaining what each block in the Planning P was and the work that was to be done followed by the individuals in each position explaining their tasks was more helpful than just going through the PowerPoint. 􀁸 Knowing a Delegation of Authority was in place prior to the incident makes the role of the Incident Commander as a decision maker more plausible. 􀁸 The ICS4ICS Demonstration underscores the need to have good pre-planning in place pri

FAQs

What key recommendations were identified by exercise participants?

Participants recommended improvements including issuing CPE certificates, creating an IT disaster recovery template, clarifying strike force vs other ICS4ICS sub-teams, documenting logistics needs, and adding templates for staffing alternatives.

What strengths did participants highlight during the exercise hot-wash?

They valued explaining Planning P blocks and role tasks more than only reviewing slides, having Delegation of Authority in place before the incident, and leveraging the ICS4ICS demonstration to emphasize pre-planning. They also noted predefined forms help capture context for later decisions.

What changes and additions were proposed to the exercise presentation and materials?

The document calls for updates to specific slides and speaker notes (including forms and planning worksheet details), adding an early glossary slide for key positions, explaining IAP distribution and NDA coverage, clarifying escalation/CIRT/SOC involvement and SIEM usage, and creating a BCP resource for ICS4ICS processes.

Sep 12, 2026

Upload by Ivy