By John Moore, CEO, ITRoundTable
It’s 2am. A SCADA alert fires on the SOC dashboard. The on-call analyst does exactly what the playbook says: contain the threat, isolate the affected asset, stop the spread. Within minutes, the asset is offline.
Within minutes after that, so is the production line.
I want to be clear that this isn’t a hypothetical I’m using to make a point. It’s a pattern our members bring to the roundtable table again and again, described in different words by different industries, but always the same shape: a well-trained IT responder made the textbook-correct call for an IT environment, and it turned out to be the wrong call for a plant floor. Nobody did anything wrong. The playbook simply wasn’t built for the environment it got applied to.
Why IT containment logic doesn’t transfer
Enterprise incident response is built around a hierarchy most security leaders know instinctively: confidentiality, then integrity, then availability. Isolate first, ask questions later — because in IT, the asset you just took offline is, worst case, an inconvenience.
OT flips that hierarchy. Availability and safety come first, because the “asset” isn’t a server, it’s the system keeping a boiler at pressure, a chiller running, or a safety interlock armed. An isolation action that’s routine in IT can trigger a hard shutdown, a pressure event, or a safety-system trip in OT. The response can end up producing more risk than the incident it was responding to.
This is exactly the seam our Best Practices work keeps surfacing: OT incident response cannot be an extension of IT SOC procedure. It has to be its own discipline, built by people who understand plant systems, safety constraints, and process dependencies, sitting alongside the SOC team rather than beneath it.
Building an OT-aware escalation path
A few things I’ve heard consistently from members who’ve done this well:
• Pre-classify your assets before an incident, not during one. Every OT-connected asset should carry a tag: safe to isolate immediately, isolate only with operations sign-off, or never isolate without a controlled shutdown sequence. If that decision is being made for the first time at 2am, it’s already too late.
• Build a joint escalation path, not a handoff. The moment a SOC alert touches anything OT-adjacent, an operations or engineering contact should be looped in as a participant, not notified after the fact. Response decisions need both perspectives in the room simultaneously.
• Know your safety instrumented systems before you know your threat actors. Responders need to understand what a given control loop does physically, not just what network segment it sits on.
Why tabletop exercises keep failing to catch this
Most tabletop exercises are still written by, and for, IT security teams — which means they test IT assumptions well and OT assumptions barely at all. A good OT tabletop has to force the uncomfortable question directly: what happens, physically, on the plant floor, the moment we take our standard containment action? NIST’s SP 800-82 guidance for OT security is explicit that ICS incident response has to prioritize safe operation above the response objectives that would normally come first in IT, and both CISA and SANS publish ICS-specific tabletop scenarios built around exactly this kind of isolation dilemma. They’re worth running, in full, with operations in the room — not just security.
Where this actually gets tested
This is precisely the kind of assumption that looks fine on paper and falls apart the moment a peer in the room says, “we tried that, and here’s what it did to our line.” That’s the value of a closed-door roundtable of security and operations executives who’ve lived this: playbooks get stress-tested by people who have no reason to be polite about the gaps, before those gaps get found by an actual incident.
If your IR plan hasn’t been through that kind of pressure test, it’s worth asking who last touched the OT sections of it — and whether they’d ever had to explain the physical consequence of a “routine” containment step.
Resources
NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security — nist.gov
CISA Tabletop Exercise Packages (CTEPs), including Industrial Control System scenarios — cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages
SANS Institute, Top 5 ICS Incident Response Tabletop Exercise Scenarios — sans.org/blog/top-5-ics-incident-response-tabletops-and-how-to-run-them
John Moore is CEO of ITRoundTable, a private, peer-driven community for IT, OT, and AI security executives at Fortune 1000 companies. This article is part of the series “Securing the Connected Industrial Enterprise,” drawn from ITRoundTable’s ongoing roundtable discussions with security and operations leaders across critical infrastructure sectors.