Scenario library / Operational technology
OT Plant Disruption: a tabletop exercise scenario
A plant historian and two operator interfaces go offline mid-shift. Engineering suspects the IT/OT boundary failed and cannot rule out malicious activity.
90 min · Executive + plant operations + technical
What this is modelled on
Modelled on incidents where malware or a segmentation failure in corporate IT reaches plant systems, and operators lose visibility while safety and production decisions must be made without it.
Why it matters
Safety outranks security and both outrank uptime, but only if the decision order is agreed in advance. This exercise forces that ordering while a shift is running.
Exercise objectives
- Confirm safe-state and shutdown authority
- Test IT/OT communication and shared situational awareness
- Rehearse production trade-off decisions with cost visibility
- Validate recovery sequencing and integrity checks
Decision points tested
- Move to safe state or continue production with degraded visibility
- Cut the IT/OT link and lose remote support
- Restore from images that may be compromised
- Regulator and insurer notification
Sample inject timeline
- T+0
Loss of view
Operators lose historian data and two interfaces; process continues on local control.
- T+20
Suspicious traffic
A firewall log shows scanning from a corporate subnet into the OT network.
- T+45
Production pressure
Commercial leadership highlights the cost per hour of a halted line.
- T+70
Recovery question
Engineering can restore interfaces from images of unknown integrity.
What the after-action report should capture
- Safety-first decision discipline
- IT/OT boundary and monitoring gaps
- Recovery integrity procedures
- Cost-of-downtime assumptions tested
Run this scenario with your team
Tailor it to your environment with AI, run the injects live, and export a web or PDF after-action report when the exercise ends.