Governance and incident response

1. The problem this lesson solves

Lessons 5.1 and 5.2 asked what must be protected and how to design for adversity. This lesson asks the governance question under time pressure: when an incident threatens an industrial sustainability system, who has authority to act, what must be protected first, which evidence must be preserved, who must be informed, and what proves that operations and carbon records are trustworthy again?

Event, alert and incident are not synonyms. An industrial event can be cybersecurity-relevant without yet being confirmed malicious, and a confirmed compromise may still require process engineering before containment.

2. Why OT incident response differs

Ordinary IT emphasis protects systems and data, restores service and often disconnects quickly. Industrial consequence includes temperature, pressure, flow, chemistry and emissions; safety is immediate; continuity may be required for safe transition; isolation may remove control, visibility or protection; evidence must include controller state, process history and physical observations; recovery must validate process behaviour, environment, timing and data reconciliation; plant operations retains physical-process authority; communications may include safety, environmental, market, cyber and verifier channels.

NIST SP 800-82 Rev. 3 frames why OT containment is consequence-aware. CISA StopRansomware materials show how ransomware and destructive events hit industrial sites as both availability and integrity crises — including evidence needed for carbon claims.

3. Governance before the incident

IEC 62443-2-1 places security-program responsibilities on the asset owner/operator. Integrators, suppliers and responders support; operating-risk accountability remains with the organization controlling the IACS. Governance layers — strategic, tactical, operational and external — need a decision-rights register for stopping processes, isolating zones, invoking degraded operation, declaring carbon data suspect, notifying cyber or environmental authorities, communicating externally and authorizing return to service.

Accountability owns the result; responsibility performs the work; consultation supplies expertise; information keeps stakeholders aware. Incident command coordinates priorities and a common operating picture — it does not automatically replace legal process, safety or plant operating authority. Those relationships must be written before the emergency.

4. Building IR capability

NIST SP 800-61 Rev. 3 reframes incident response as part of cybersecurity risk management: Govern, Identify and Protect prepare; Detect, Respond and Recover handle incidents; improvement feeds lessons into all functions. ISO/IEC 27035 offers a generic lifecycle that industrial use must extend with physical stabilization, safety/environmental authority, OT evidence and process-aware recovery. NIST IR 8374r1 adds a ransomware profile useful when encryption or destruction threatens historians and report packages.

Program components include approved policy, OT/cloud/supplier/sustainability scope, taxonomy and severity, on-call roster, decision-rights matrix, evidence and chain-of-custody procedures, safe-containment and degraded-operation playbooks, notification contacts, communications templates, recovery criteria and an exercise program. Preparedness artefacts — contact roster, system and process-safety dossiers, evidence map, notification matrix, recovery book, jump kit, communication kit — fail if they exist only as unread PDFs.

5. Detect, validate and triage

Multi-source detection spans identity, network, host, configuration, process, environmental/carbon and human observation — each with limits. Validation asks what was observed, by which clock, whether the condition is ongoing, which physical/safety/environmental/carbon records may be affected, whether maintenance or data-quality error could explain it, which independent source can confirm or contradict, and which reversible action is least likely to worsen physical conditions.

You should classify cyber-only, cyber-physical, data-integrity, safety/environmental, supply-chain or unconfirmed anomaly cases with an initial lead. Severity across safety, environment, operations, cyber, carbon evidence, regulatory and external impact is dynamic — you should revise it with time, evidence, decision maker and resulting actions recorded.

6. Stabilize and contain

Priority order should put protecting life and preventing environmental harm first, then stabilising the process; preventing further unauthorized action; preserving critical visibility and protection; preserving evidence; maintaining minimum viable service; and supporting investigation and notification. Containment is an engineering decision. Disabling an identity, closing a conduit, blocking writes while preserving reads, placing the process in local mode, moving to a conservative recipe, isolating a historian or executing controlled shutdown each have prerequisites and risks.

A plant-specific Safe Cyber Position defines trusted control mode, permitted conduits, available monitoring, staffing, conservative limits, evidence capture, entry authority, maximum duration and exit criteria. Stop conditions include loss of independent protection or reliable indication, unverified controller logic, process outside the degraded envelope, unacceptable operator workload, missing evidence for safe continuation, or inability to prevent unauthorized control.

7. Evidence, forensics and notification

Responders must preserve evidence while maintaining safety. Volatile evidence should be collected first, subject to process safety; chain of custody must be documented; clock settings should be preserved and offsets calculated rather than silently normalizing timestamps across controllers, historians, identity systems and manual observations. Forensic restraint matters: unvalidated tools and active scanning can destabilize legacy OT.

A common operating picture distinguishes facts, assumptions, hypotheses, decisions, actions, owners, deadlines and unresolved questions — and reports operational status separately from evidence confidence. External statements should not claim operations, data or emissions are unaffected until evidence supports that claim.

NIS2 illustrates directive-level early-warning (often within 24 hours of awareness) and incident notification (often within 72 hours) clocks that may start before technical investigation completes — verify national transposition and sector thresholds. Parallel tracks can include cyber authority/CSIRT, environmental regulator, safety authority, KVKK / personal-data breach, carbon market/verifier, customers/contracts, insurer and law enforcement. Turkish plants should treat EPDK continuity expectations and privacy notification as distinct owners and clocks, not as one email.

8. Eradicate, recover and return to service

Eradication removes persistence, malicious changes, unauthorized identities and vulnerable pathways — often staged in OT because immediate patching or reimaging can create unacceptable downtime. Recovery rebuilds foundational services; validates firmware, logic and credentials; restores safety and basic control before optimization; restores monitoring and reconciles buffered/manual/restored records; reconnects enterprise services through controlled conduits; tests; and obtains documented return-to-service authorization across process, safety, environment, cybersecurity, configuration, evidence, carbon record and operations domains.

Carbon-record reconciliation bounds affected timestamps; identifies raw/validated/adjusted/reported data touched; reconciles meters, historian, ERP, invoices, production and manuals; restores approved factors and models; labels gaps and uncertainty; recalculates; obtains independent review where required; and corrects, qualifies, withdraws or reissues claims under defined authority. Operational recovery is not assurance recovery.

9. Learning and improvement

SP 800-61r3 places improvement around the full risk-management lifecycle. Root-cause layers include direct cause, technical condition, process condition, governance condition and systemic condition. “Train staff” and “be more careful” are weak when architecture, identity, incentives or procedures are defective. Strong actions change the system, include measurable acceptance criteria and are retested against the original scenario. Closure metrics should include time to stabilize, contain, notify, restore minimum viable service, achieve trusted recovery and reconcile sustainability data — plus corrective-action completion and exercise performance.

10. Applied case: LumaWorks tabletop

LumaWorks Materials runs a timed tabletop. A contractor identity accessed the historian outside the window. Meter scaling may have changed. A carbon result is in doubt. Operations is completing a sensitive thermal batch. IT proposes immediate isolation. Sustainability wants the claim suspended. Legal asks when reporting clocks began. The vendor requests emergency remote access.

Inject sketch: you might validate suspicious access and establish command; classify a 9% gas dashboard–meter disagreement; decide vendor access under pressure; choose safe containment when historian isolation threatens trend visibility; confirm independent high-temperature trip health; answer a verifier’s claim-integrity question with a holding response; bound two weeks of potentially affected records; revise recovery when a trusted PLC backup exists but the engineering-tool license is expired; separate operational restart from unreconciled carbon data; and update severity when evidence suggests credential compromise without process command.

Model decisions often include suspending the affected claim without alleging fraud; revoking the contractor identity and closing the remote conduit; retaining local PLC control after configuration comparison; keeping independent protection active; preserving historian evidence before reconfiguration; using local/manual capture and marking the period provisional; denying uncontrolled vendor access (you can use time-bound monitored access if necessary); and tracking awareness time for legal threshold analysis from the first credible indication.

11. References

• NIST. SP 800-61 Rev. 3 — Incident Response Recommendations. https://csrc.nist.gov/pubs/sp/800/61/r3/final
• NIST. IR 8374r1 — Ransomware Risk Management. https://nvlpubs.nist.gov/nistpubs/ir/2026/NIST.IR.8374r1.pdf
• CISA. StopRansomware. https://www.cisa.gov/stopransomware
• IEC 62443-2-1 / ISA–IEC 62443 series. https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• ISO/IEC 27035-1:2023 — Information security incident management. https://www.iso.org/standard/78973.html
• Directive (EU) 2022/2555 (NIS2). https://eur-lex.europa.eu/eli/dir/2022/2555/oj
• NIST. SP 800-82 Rev. 3 — Guide to OT Security. https://csrc.nist.gov/pubs/sp/800/82/r3/final
• EPDK. Energy-sector cybersecurity resources. https://www.epdk.gov.tr/
• KVKK. Personal-data protection / breach resources. https://www.kvkk.gov.tr/