[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-253710-105":53,"doc-detail-253710-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","incident-response-for-operational-technology-ot-preparing-for-and-responding-to-ot-security-incidents-in-industrial-environments-march-2023","Incident Response for Operational Technology (OT) - Preparing for and Responding to OT Security Incidents in Industrial Environments - March 2023","","Incident Response for Operational Technology (OT) provides structured guidance for preparing for and responding to OT security incidents in industrial environments. The paper connects incident response with incident management principles, explaining why OT incidents differ from IT and how to align scope, data sets, and forensic collection. It details OT-specific preparation needs across facilities, equipment, personnel, and procedures, then maps PICERL phases to industrial contexts. The document also covers communication, coordination, and plan-to-action execution, supported by checklists and appendices.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/incident-response-for-operational-technology-ot-preparing-for-and-responding-to-ot-security-incidents-in-industrial-environments-march-2023/253710/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/incident-response-for-operational-technology-ot-preparing-for-and-responding-to-ot-security-incidents-in-industrial-environments-march-2023/253710.png","ImageObject",442,249,{"name":88,"@type":89},"Jake","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-11-01","2026-09-13",true,{"@type":98,"interactionType":99,"userInteractionCount":8},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What does the paper cover about OT incident response preparation and response?","Question",{"text":108,"@type":109},"It outlines how to prepare for and respond to OT security incidents, linking incident response to incident management principles and describing OT-specific operational needs across facilities, equipment, personnel, and procedures.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How is OT incident response different from IT incident response?",{"text":113,"@type":109},"The paper explains that OT incident response requires different scope, context, and data sets, including tailored forensic data collection approaches for industrial environments.",{"name":115,"@type":106,"acceptedAnswer":116},"What are the phases of incident response within industrial environments (PICERL)?",{"text":117,"@type":109},"It describes preparation, identification, containment, eradication, recovery, lessons learned, and assigns ownership of these phases to PICERL-related responsibilities in industrial settings.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},253710,1791747561,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":8,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":20},962084928904,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","W H I T E P A P E R  \nIncident Response for Operational Technology (OT)  \nPreparing for and Responding to OT Security Incidents in Industrial Environments  \nTIM ENNIS | SENIOR INDUSTRIAL INCIDENT RESPONDER  \nDANA-MEGAN ROSSI | SENIOR DIRECTOR OF GLOBAL SERVICES  \nKAI THOMSEN | DIRECTOR OF GLOBAL INCIDENT RESPONSE SERVICES JACOB BENJAMIN | DIRECTOR OF PROFESSIONAL SERVICES  \nJAN HOFF | PRINCIPAL INDUSTRIAL INCIDENT RESPONDER  \nSETH ENOKA | PRINCIPAL INDUSTRIAL RESPONDER II FAHAD ALQAHTANI | PRINCIPAL INDUSTRIAL RESPONDER MARCH 2023  \n [info@dragos.com](info@dragos.com)  @DragosInc  \n @Dragos, Inc. 1  \nW H I T E P A P E R  \nTABLE OF CONTENTS  \nExecutive Summary ................................................................................................................................. 3  \nIntroduction ............................................................................................................................................... 4  \nThe Convergence of Incident Response and Incident Management Principles ........................... 5  \nWhat is Incident Response and Incident Management? ................................................................................................. 5  \nIncident Command across the Globe – Communication & Coordination for IM.................................................... 6  \nOT Incident Response .................................................................................................................................................................... 7  \nWhy is OT Incident Response Different than IT Response? ...........................................................8  \nScope and Context........................................................................................................................................................................... 8  \nOrganizational Capability ........................................................................................................................................................... 11  \nPriorities and Data Loss .............................................................................................................................................................. 12  \nDifferent Data Sets for IT and OT ..............................................................................................................................................13  \nForensic Data Collection ..............................................................................................................................................................15  \nHow the Phases of Incident Response are Different Within Industrial Environments ........... 16  \nPreparation........................................................................................................................................................................................16  \nIdentification.....................................................................................................................................................................................17  \nContainment.....................................................................................................................................................................................18  \nEradication ........................................................................................................................................................................................18  \nRecovery.............................................................................................................................................................................................19  \nLessons Learned .............................................................................................................................................................................19  \nOwnership of the PICERL Phases...................................................................................","cbCaimhohdeqt5ab","https://ap.wps.com/l/cbCaimhohdeqt5ab","pdf",3260116,41,"English","# Executive Summary\n# Introduction\n## The Convergence of Incident Response and Incident Management Principles\n## OT Incident Response\n### Why is OT Incident Response Different than IT Response?\n### Scope and Context\n# How to Prepare for Effective Incident Response for OT\n## Facilities\n## Equipment\n## Personnel\n## Procedures\n## Communications\n# Putting the Actions Into a Plan, and the Plan Into Action\n# Conclusion\n# Appendix A - Acronyms Table\n# Appendix B - Incident Response Preparedness Key Actions Checklist\n# Appendix C - Methodology for Creating and Developing a CMF\n# Appendix D - Incident Dashboard and Reporting Example","[{\"question\":\"What does the paper cover about OT incident response preparation and response?\",\"answer\":\"It outlines how to prepare for and respond to OT security incidents, linking incident response to incident management principles and describing OT-specific operational needs across facilities, equipment, personnel, and procedures.\"},{\"question\":\"How is OT incident response different from IT incident response?\",\"answer\":\"The paper explains that OT incident response requires different scope, context, and data sets, including tailored forensic data collection approaches for industrial environments.\"},{\"question\":\"What are the phases of incident response within industrial environments (PICERL)?\",\"answer\":\"It describes preparation, identification, containment, eradication, recovery, lessons learned, and assigns ownership of these phases to PICERL-related responsibilities in industrial settings.\"}]","Incident Response for Operational Technology (OT) - Preparing for and Responding to OT Security Incidents in Industrial Environments - March 2023 | PDF",1789269208]