OT incident response

You often cannot isolate, power down or image a system in an industrial environment.

The machine is running a physical process that may be dangerous to stop and expensive to restart, and the evidence you want lives on equipment that cannot be taken away. Response plans imported from IT fail here immediately. What works is decided in advance with the people who run the process, including who has authority to stop it.