Three engagement modes, scoped distinctly
Retained IR. Pre-signed master services agreement, named senior on-call, agreed response times, periodic readiness validation. The only mode that meaningfully compresses response time when it matters.
Emergency response. Unretained, best-effort mobilisation. Possible; slower; negotiates scope under pressure — which is the wrong time to do it.
Post-incident forensics and hardening. After the immediate fire is out, the second engagement most operators actually need — and frequently skip.
Retained IR — Preparedness Before the Event
- Master Services Agreement and Rules of Engagement pre-signed, with site-specific exclusions and authorities documented
- Named senior responder, named deputy, tested out-of-band contact tree
- Response SLA sized to criticality: 1-hour acknowledge / 4-hour remote mobilisation / 24-hour on-site for Tier-1 critical infrastructure
- Pre-built forensic collection toolkits, chain-of-custody templates, and evidence-preservation protocols tailored to each site's control-system vendors
- Quarterly readiness checks: contact-tree test, toolkit verification, and runbook walk-through
- Crown-jewel identification and IR-specific backup validation (offline, immutable, tested restore)
- Coordination protocols with the operator's legal counsel, cyber-insurer, and national CERT
Emergency Response — First 72 Hours
- Triage and scope assessment — what is happening, what is at risk, what must move in the next hour
- Containment options presented with process-impact classification: a choice architecture for the operator, not a unilateral action
- Joint action with plant engineering and safety: no containment move executed without sign-off
- Evidence preservation on live systems where shutdown is not survivable; volatile memory, network telemetry, historian data, and controller state prioritised
- Parallel workstreams: technical containment, regulator notification, internal/external communications, and insurer coordination — run concurrently, not sequentially
- NIS2 24-hour early-warning drafting support and sector-authority notification assistance (BSI, ANSSI, NCA, CERT-In) — written in language the authority expects
- Executive briefings on a fixed cadence (typically 4-hourly in the first 48 hours) — board-grade, not technical logs
ICS/OT Forensics — Where IT Forensics Stops
- Controller-level forensics on PLCs, RTUs, IEDs, and safety controllers: project-file comparison against known-good baselines, logic-diff analysis, firmware integrity verification
- Engineering workstation forensics (Siemens TIA, Rockwell Studio 5000, Schneider EcoStruxure, GE Proficy, ABB 800xA and equivalents)
- HMI, historian, and batch-record forensic review — including regulatory-critical records (GxP, FDA 21 CFR Part 11, API 1164)
- Industrial protocol forensics: Modbus, DNP3, S7, OPC-UA, IEC 61850, EtherNet/IP, PROFINET traffic reconstruction from capture files or passive monitoring archives
- Device firmware extraction, reverse engineering, and implant detection (nation-state scenarios, NDA-bound)
- Network-based forensics with zone-and-conduit awareness — lateral-movement reconstruction across the Purdue model
- Timeline reconstruction across IT, OT, and physical-security telemetry — a single narrative, not three
Ransomware Response in Industrial Environments
- Immediate posture assessment: scope of encryption, OT-adjacency, safety-system exposure, data-exfiltration indicators
- Kill-chain containment without operational collapse: segmentation enforcement, credential rotation, and AD isolation sequenced against plant dependencies
- Ransom-decision advisory — independent technical view to inform (not make) the commercial and legal decision; OFAC and sanctions screening coordinated with counsel
- Backup validation under attack conditions: immutability, air-gap integrity, and tested restore sequence for OT-critical systems
- Recovery sequencing aligned to process-safety hierarchy: safety systems first, utilities, then production
- Post-event: root cause, control-failure analysis, and hardening backlog — not just "restore and move on