OT Cyber Forensics & Incident Response

OT Cyber Forensics & Incident Response Contain. Preserve. Recover. In That Order

99.9%

Threat detection and prevention rate

EuroShield provides incident response and digital forensics for operational technology environments where the first imperative is not evidence collection — it is keeping the plant safe and the process running.

OT incident response is fundamentally different from IT IR. A standard IR playbook — isolate the host, pull memory, re-image — can trip a safety-instrumented system, desynchronise a redundant controller pair, or strand a batch in the middle of a regulated process. Our methodology is engineered around that reality: containment actions are pre-classified against process impact, executed alongside the operations and safety teams, and sequenced so that forensic integrity and production continuity are preserved together.

Work is aligned to IEC 62443-2-1 incident handling (CSMS element 4.3.4), IEC 62443-3-3 SR 6 (timely response and event recovery), NIS2 Article 23 incident reporting (24-hour early warning, 72-hour notification, one-month final report), sector obligations (KRITIS BSI reporting, LPM ANSSI, UAE NCA OTCS, Saudi NCA OTCC, CERT-In six-hour), and — where in-scope components are involved — EU Cyber Resilience Act active-exploitation and vulnerability disclosure duties.

Three engagement modes, scoped distinctly

Retained IR. Pre-signed master services agreement, named senior on-call, agreed response times, periodic readiness validation. The only mode that meaningfully compresses response time when it matters.

Emergency response. Unretained, best-effort mobilisation. Possible; slower; negotiates scope under pressure — which is the wrong time to do it.

Post-incident forensics and hardening. After the immediate fire is out, the second engagement most operators actually need — and frequently skip.

Retained IR — Preparedness Before the Event

Master Services Agreement and Rules of Engagement pre-signed, with site-specific exclusions and authorities documented
Named senior responder, named deputy, tested out-of-band contact tree
Response SLA sized to criticality: 1-hour acknowledge / 4-hour remote mobilisation / 24-hour on-site for Tier-1 critical infrastructure
Pre-built forensic collection toolkits, chain-of-custody templates, and evidence-preservation protocols tailored to each site's control-system vendors
Quarterly readiness checks: contact-tree test, toolkit verification, and runbook walk-through
Crown-jewel identification and IR-specific backup validation (offline, immutable, tested restore)
Coordination protocols with the operator's legal counsel, cyber-insurer, and national CERT

Emergency Response — First 72 Hours

Triage and scope assessment — what is happening, what is at risk, what must move in the next hour
Containment options presented with process-impact classification: a choice architecture for the operator, not a unilateral action
Joint action with plant engineering and safety: no containment move executed without sign-off
Evidence preservation on live systems where shutdown is not survivable; volatile memory, network telemetry, historian data, and controller state prioritised
Parallel workstreams: technical containment, regulator notification, internal/external communications, and insurer coordination — run concurrently, not sequentially
NIS2 24-hour early-warning drafting support and sector-authority notification assistance (BSI, ANSSI, NCA, CERT-In) — written in language the authority expects
Executive briefings on a fixed cadence (typically 4-hourly in the first 48 hours) — board-grade, not technical logs

ICS/OT Forensics — Where IT Forensics Stops

Controller-level forensics on PLCs, RTUs, IEDs, and safety controllers: project-file comparison against known-good baselines, logic-diff analysis, firmware integrity verification
Engineering workstation forensics (Siemens TIA, Rockwell Studio 5000, Schneider EcoStruxure, GE Proficy, ABB 800xA and equivalents)
HMI, historian, and batch-record forensic review — including regulatory-critical records (GxP, FDA 21 CFR Part 11, API 1164)
Industrial protocol forensics: Modbus, DNP3, S7, OPC-UA, IEC 61850, EtherNet/IP, PROFINET traffic reconstruction from capture files or passive monitoring archives
Device firmware extraction, reverse engineering, and implant detection (nation-state scenarios, NDA-bound)
Network-based forensics with zone-and-conduit awareness — lateral-movement reconstruction across the Purdue model
Timeline reconstruction across IT, OT, and physical-security telemetry — a single narrative, not three

Ransomware Response in Industrial Environments

Immediate posture assessment: scope of encryption, OT-adjacency, safety-system exposure, data-exfiltration indicators
Kill-chain containment without operational collapse: segmentation enforcement, credential rotation, and AD isolation sequenced against plant dependencies
Ransom-decision advisory — independent technical view to inform (not make) the commercial and legal decision; OFAC and sanctions screening coordinated with counsel
Backup validation under attack conditions: immutability, air-gap integrity, and tested restore sequence for OT-critical systems
Recovery sequencing aligned to process-safety hierarchy: safety systems first, utilities, then production
Post-event: root cause, control-failure analysis, and hardening backlog — not just "restore and move on