This guide shows how to investigate an OT security incident by preserving evidence, triaging federal notices, and verifying the fix. Operational Technology (OT) means the hardware and software that control physical processes, such as pumps, valves, and manufacturing lines. Investigators must protect safety, reliability, and uptime while they collect proof. That constraint shapes every choice about what to copy, what to isolate, and when to report.
Table of Contents
- Preserve evidence without stopping operations
- What baseline should guide the investigation?
- How do you triage OT notices?
- How do you verify exposure is closed?
- When must you notify CISA?
Preserve evidence without stopping operations
Build collection, storage, and access procedures before an incident. Control Global reporting on CISA, FBI, and EPA says the agencies jointly released a Water and Wastewater Sector guide to help owners build response plans, preserve evidence, and coordinate federal roles.
JD Supra analysis of that guide says utilities should define evidence procedures, ask regional CISA or FBI offices for retention guidance, and use federal host, network, and cyber-physical forensic support. Do not wipe or rebuild a controller before images and logs are preserved.
- Define what to collect: host images, network captures, OT logs, and physical-process data.
- Record storage location, access list, and retention period.
- Contact the regional CISA or FBI office before purging data.
- Request federal forensic support for host, network, and cyber-physical artifacts.
What baseline should guide the investigation?
NIST published SP 800-82 Rev. 3 as the federal Guide to Operational Technology Security, covering ICS, SCADA, DCS, and PLCs while addressing safety, reliability, and performance limits, described in the federal OT security guide. Use it to scope systems, prioritize safe collection methods, and separate IT actions from OT actions.
Map each affected controller and supervisory system to its safety impact. Treat monitoring first, active scanning second. Document why each intrusive step was necessary.
How do you triage OT notices?
CISA issues recurring Industrial Control Systems advisories with current vulnerabilities, exploits, affected products, technical details, and mitigations, such as one September 2025 advisory. Match the advisory product list to your asset inventory first. Then check exploit status and mitigation steps.
Volume makes triage mandatory. Forescout/Vedere Labs, citing CISA ICS-CERT, reports 3,637 advisories between March 2010 and Jan. 31, 2026, covering 12,174 vulnerabilities in 2,783 products from 689 vendors. Track advisories by vendor, product version, and site impact, not by headline severity alone.
How do you verify exposure is closed?
Check the Known Exploited Vulnerabilities catalog during every investigation. Under BOD 22-01, CISA maintains the catalog as a living list of CVEs posing significant federal risk, and federal civilian agencies must remediate listed flaws by assigned due dates. Apply the same verification logic to private OT sites.
Confirm patch, configuration change, or compensating control on each affected asset. CISA reported on Oct. 13, 2026 that it added Ivanti Connect Secure flaw CVE-2026-104935, a remotely exploitable unauthenticated command-execution zero-day, to the catalog and urged immediate patching, detailed in the Ivanti patching alert. Keep version proof and test results with the case file.
When must you notify CISA?
CISA states on CISA's CIRCIA page that covered critical-infrastructure entities will need to report covered cyber incidents within 72 hours and ransom payments within 24 hours. Mandatory reporting starts only after the final rule takes effect.
Do not wait for the mandate to prepare reporting data. Save timelines, affected systems, ransom demands, and payment records now. Ask counsel and regional contacts which voluntary channel fits the incident.
You Might Also Like
- Cybersecurity — KEV Catalog Prevention Guide: Controls, Monitoring, and Recovery
- Cybersecurity — Power Grid Cyberattack Update 2026: Disclosure, Response, and Open Questions
- Cybersecurity — City Government Hack Response Checklist: Passwords, Accounts, and Credit