What it means
OT incident exercises rehearse how people, systems, procedures, vendors, and physical operations respond to cyber events under realistic safety and continuity constraints.
Why it matters
A discussion-only tabletop may validate communication but miss technical, timing, access, backup, failover, and process assumptions that determine real performance.
Practical focus
- Set measurable objectives and scenarios tied to credible threats, process states, operational consequences, and known control dependencies.
- Include operations, engineering, safety, security, leadership, communications, legal, vendors, and emergency partners at the appropriate exercise level.
- Test notification, evidence, decision authority, safe containment, manual operation, recovery, shift turnover, and external coordination.
- Preserve this evidence: Retain the exercise plan, assumptions, injects, attendance, observations, decisions, metrics, gaps, owners, corrective actions, and retest evidence.
- Exercise this failure scenario: The plan appears complete until an exercise shows that remote access cannot be revoked, backups cannot be restored, or no one can authorize a safe shutdown.
Common mistakes
- Using the label OT Incident Exercises without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that OT Incident Exercises operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: The plan appears complete until an exercise shows that remote access cannot be revoked, backups cannot be restored, or no one can authorize a safe shutdown.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: