RES-01 Cyber security incident planning

The principle

The three actions

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

1. Action 1 of 3

   Update business and operational continuity plans to reflect the impact that isolation will have on business and operational processes.

   In plain English: Update your business and operational continuity plans. Show how isolating OT will affect the way the business and operations run.

   Domains

   Visibility and response

2. Action 2 of 3

   Use documented, tested and approved OT incident response procedures when responding to cyber security incidents, covering situations such as safety events, setting out who participates in response and recovery, including third parties, loss of visibility, and workstation compromise.

   In plain English: Use written, tested, approved OT incident response procedures, covering situations such as safety events, lost visibility and a hacked workstation. Name who responds and recovers, including third parties.

   Domains

   Visibility and response

3. Action 3 of 3

   Establish and maintain a document management capability for system documentation, and retain per-site copies of playbooks, drawings, installation, reset and configuration instructions, break-glass secrets and keys, and emergency contact information in a form that does not depend on the systems being recovered.

   In plain English: Set up and keep system document management. Keep per-site copies of playbooks, drawings, installation, reset and configuration instructions, emergency secrets, keys and contacts, usable without the affected systems.

   Domains

   Visibility and response