--- title: Do you have an incident response plan for your industrial control systems? date: 2021-09-14T10:31:00-04:00 author: jessica napert canonical_url: "https://www.bbaconsultants.com/en-ca/publications/do-you-have-an-incident-response-plan-for-your-industrial-control-systems" section: Publications --- The frequency of cyber attacks and compromises impacting critical infrastructure, such as pipelines, water treatment plants and power transmission grids, is on the rise. Based on this, the question is no longer whether my organization can be compromised, but rather when will it be compromised. 1. ## The importance of having a robust incident plan Most organizations have mature cyber incident response plans for their corporate IT infrastructure, but often, response plans for industrial control systems (ICS) and critical processes are not as mature or may only address physical hazards. The most common ICS devices are: - field telemetry devices, such as instruments and sensors - field controllers, such as remote terminal units, intelligent electronic devices and programmable logic controllers - human machine interfaces, which allow operators to monitor and control processes Cyber attackers can exploit vulnerabilities in these devices or other network connected systems that impact your ICS devices and systems. So, it’s important to have a robust incident response plan that specifically addresses your organization’s ICS. To develop an efficient incident response plan, here’s a list of the most important topics to cover: ### Response team An incident response team must be established in advance and documented in the response plan. Clearly defined roles and responsibilities should be assigned to various team members. The team should be comprised of individuals who are familiar with incident handling and response, and who have the authority and management support to make key decisions; however, having technical staff with hands-on knowledge of your organization’s control system architecture and ICS equipment is critical. Depending on the number and location of your organization’s facilities, the response team may be centralized, distributed or a combination of both. ### Detection A description of methods to identify cybersecurity incidents is required, including both automated systems, such as an intrusion detection system (IDS) or security information and event management (SIEM), and detection of abnormal system or component behaviour by human observation. Methods to identify failures in automated systems are also recommended, as these systems are potential targets for cyber attackers. ### Classification It’s necessary to define and describe what qualifies as cybersecurity and non-cybersecurity incidents. An organization may choose to have different types or levels of cybersecurity incidents based on scope or impact. This will assist in appropriately scaling the resources and engagement effort required to respond to different incidents and to prioritize response to multiple incidents. ### Notification Procedures must be established to notify incident response team members and appropriate external agencies, such as vendors, and law enforcement or government security agencies. All relevant contact information should be included (phone numbers, email addresses, etc.) ### Response Detailed procedures must be developed for each class of security incident that address how to contain the attack, eradicate the compromise and restore to normal operations. Data retention should be included to support future forensics, lessons learned and prosecution of attackers. Be sure to include contingency situations, such as 24/7 operations, unavailable responders and loss of power or communications. Once your incident response plan is in place, it is important to: 1. Ensure all named responders are trained and aware of their responsibilities. 2. Keep the plan up to date. Named responders may change roles or leave the organization and, therefore, need to be promptly replaced. Phone numbers and email addresses may change, and contact lists will need to be updated quickly. Automated systems or technologies may be upgraded or replaced, and response procedures need to be updated. 3. Go through the plan on a regular basis. Any lessons learned should be documented and incorporated into the plan. If the plan is updated, ensure it’s shared with all named responders. ## Conclusion ICS cybersecurity incidents can lead to physical or safety process incidents. Therefore, consider leveraging existing organizational incident response structures and approaches, such as integrating an ICS cybersecurity incident response plan into physical process and safety incident response plans. If your organization requires help in setting up a new incident response plan or reviewing an existing one, please contact us. This content is for general information purposes only. All rights reserved ©BBA 1. ![Pierre Janse van Rensburg](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/2926/Pierre-Janse-van-Rensburg.webp) Pierre Janse Van Rensburg, GCIH Senior Consulting Expert, ICS Cybersecurity [ ](https://www.linkedin.com/in/pierrejansevanrensburg/) - [ 27 Jul 2026 Mining and Metals Early tailings decisions shape long-term mine performance - ![Geraldine Cosset](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/206707/Geraldine-Cosset.webp) - ![Jared Purdy](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/212424/Jared-Purdy.webp) ](https://www.bbaconsultants.com/en-ca/insights/early-tailings-decisions-shape-long-term-mine-performance "Early tailings decisions shape long-term mine performance") - [ 02 Jul 2026 Mining and Metals Python: A key tool for data analysis in mineral processing - ![Charles Blais](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/211197/Charles-Blais.webp) - ![Juan Pablo Vergara](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/211266/Juan-Pablo-Vergara.webp) ](https://www.bbaconsultants.com/en-ca/insights/python-a-key-tool-for-data-analysis-in-mineral-processing "Python: A key tool for data analysis in mineral processing") - [ 19 Jun 2026 Mining and Metals Speed is earned early in projects - ![Mm employee men jean lheureux retouch web SQ LR BBA](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/204266/mm_employee_men_jean-lheureux_retouch_web_SQ_LR_BBA.webp) - ![Mm employee men benoit richard retouch web SQ LR BBA](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/203602/mm_employee_men_benoit-richard_retouch_web_SQ_LR_BBA.webp) ](https://www.bbaconsultants.com/en-ca/insights/speed-is-earned-early-in-projects "Speed is earned early in projects") - [ 17 Jun 2026 Industrial data platforms: building a solid foundation to optimize your operations - ![Pierre Boucher](https://www.assets.bbaconsultants.com/bba-production-assets/production/images/avatars/_size_avatar/2671/Pierre-Boucher.webp) Pierre Boucher, P.Eng. Senior Engineer, Operational Technology and Infrastructure ](https://www.bbaconsultants.com/en-ca/insights/industrial-data-platforms-building-a-solid-foundation-to-optimize-your-operations "Industrial data platforms: building a solid foundation to optimize your operations") [ See all ](https://www.bbaconsultants.com/en-ca/insights "Go to Publications listing page") Let’s think it further together [ Contact us ](https://www.bbaconsultants.com/en-ca/contact) The frequency of cyber attacks and compromises impacting critical infrastructure, such as pipelines, water treatment plants and power transmission grids, is on the rise. Based on this, the question is no longer whether my organization can be compromised, but rather when will it be compromised. 1. ## The importance of having a robust incident plan Most organizations have mature cyber incident response plans for their corporate IT infrastructure, but often, response plans for industrial control systems (ICS) and critical processes are not as mature or may only address physical hazards. The most common ICS devices are: - field telemetry devices, such as instruments and sensors - field controllers, such as remote terminal units, intelligent electronic devices and programmable logic controllers - human machine interfaces, which allow operators to monitor and control processes Cyber attackers can exploit vulnerabilities in these devices or other network connected systems that impact your ICS devices and systems. So, it’s important to have a robust incident response plan that specifically addresses your organization’s ICS. To develop an efficient incident response plan, here’s a list of the most important topics to cover: ### Response team An incident response team must be established in advance and documented in the response plan. Clearly defined roles and responsibilities should be assigned to various team members. The team should be comprised of individuals who are familiar with incident handling and response, and who have the authority and management support to make key decisions; however, having technical staff with hands-on knowledge of your organization’s control system architecture and ICS equipment is critical. Depending on the number and location of your organization’s facilities, the response team may be centralized, distributed or a combination of both. ### Detection A description of methods to identify cybersecurity incidents is required, including both automated systems, such as an intrusion detection system (IDS) or security information and event management (SIEM), and detection of abnormal system or component behaviour by human observation. Methods to identify failures in automated systems are also recommended, as these systems are potential targets for cyber attackers. ### Classification It’s necessary to define and describe what qualifies as cybersecurity and non-cybersecurity incidents. An organization may choose to have different types or levels of cybersecurity incidents based on scope or impact. This will assist in appropriately scaling the resources and engagement effort required to respond to different incidents and to prioritize response to multiple incidents. ### Notification Procedures must be established to notify incident response team members and appropriate external agencies, such as vendors, and law enforcement or government security agencies. All relevant contact information should be included (phone numbers, email addresses, etc.) ### Response Detailed procedures must be developed for each class of security incident that address how to contain the attack, eradicate the compromise and restore to normal operations. Data retention should be included to support future forensics, lessons learned and prosecution of attackers. Be sure to include contingency situations, such as 24/7 operations, unavailable responders and loss of power or communications. Once your incident response plan is in place, it is important to: 1. Ensure all named responders are trained and aware of their responsibilities. 2. Keep the plan up to date. Named responders may change roles or leave the organization and, therefore, need to be promptly replaced. Phone numbers and email addresses may change, and contact lists will need to be updated quickly. Automated systems or technologies may be upgraded or replaced, and response procedures need to be updated. 3. Go through the plan on a regular basis. Any lessons learned should be documented and incorporated into the plan. If the plan is updated, ensure it’s shared with all named responders. ## Conclusion ICS cybersecurity incidents can lead to physical or safety process incidents. Therefore, consider leveraging existing organizational incident response structures and approaches, such as integrating an ICS cybersecurity incident response plan into physical process and safety incident response plans. If your organization requires help in setting up a new incident response plan or reviewing an existing one, please contact us. This content is for general information purposes only. All rights reserved ©BBA