OT Incident Response, ICS Forensics, and Controlled Recovery
OT Incident Response That Puts Process Safety First
A setpoint moved, an operator display went dark or a vendor account that should be disabled just logged in, and leadership wants to know within the hour whether it is an attack. Global Digital Forensics responders establish what changed, which access paths reached the control network and whether the intruder still has a way in. Every collection and containment step runs inside the safety limits your operators set, and the evidence is preserved before the restore overwrites it.
The first hour
When the Controller Changed and Nobody Touched It
An industrial incident rarely announces itself as one. It looks like a trip, a strange alarm, a historian trace that does not match what the operators remember. The first hour decides whether the plant gets an answer or a guess, because that is when engineering workstations get rebooted, controller projects get reloaded and the evidence that explains the event is overwritten by the people trying to fix it.
Call (800) 868-8189, answered 24/7. Tell us the affected operation, its current state and who holds operational authority on site. If you suspect accounts or systems are compromised, call from a phone and use a channel the attacker would not be reading.
The engagement
Contain the Threat Inside Your Safety Limits
Office network playbooks break plants. Disconnecting, rebooting or scanning an industrial device can trip a process or leave a controller half written, and limited redundancy, vendor dependencies and environmental consequence shape every acquisition and containment decision.
Our responders work beside your operators and control system specialists. They preserve the relevant evidence, build a defensible sequence of events and support containment that keeps the plant safe, using methods adapted to the process and to NIST SP 800-82 Revision 3, the NIST guide to operational technology security.
Scope
OT incident triage
Affected processes, critical assets, safety limits and evidence priorities, agreed jointly with operations on the first call.
Passive evidence collection
Available logs, network captures, historian data and engineering records come first, before any intrusive method is considered.
Engineering workstation forensics
HMIs, engineering stations, jump hosts and the Windows systems around them hold the session and project history.
Controller and configuration review
Logic, configuration, firmware and change records are compared where the platform supports it and the operator confirms it is safe.
IT and OT boundary analysis
Identity, remote access, firewall and enterprise events are correlated with the activity seen on the control system.
Recovery evidence and lessons
Restoration decisions and validated configurations are preserved for oversight bodies, insurers and any later claim.
Not sure which of those your event needs first? Call (800) 868-8189 and we will tell you which evidence is at risk in the next hour.
Your Operators Decide What Is Safe
Process safety, environmental limits and acceptable operating conditions belong to the operator, and every GDF preservation and analysis step is planned inside them. Nothing touches a device without operator approval. That is the method, not a courtesy.
The response plan names the evidence that matters most, the approvals needed before anyone touches equipment, the fragile assets, the available backups and the stop conditions. If imaging an HMI's memory would put the process at risk, we write that limitation into the record and corroborate from safer sources such as the historian, the engineering workstation's project files or the switch logs, and the report says plainly what those sources can and cannot replace.
Weighing whether a device is safe to image? Read our guide to the five mistakes that destroy digital evidence before a restart makes the decision for you.
Attack, Fault, or Someone Doing Their Job
A process anomaly is a symptom. Equipment failure, unlogged maintenance, a configuration error and an intrusion can all produce the same one. We line up the technical and operational records, test which explanations survive contact with the evidence and say so when more than one does.
The sources are engineering workstation records, remote access logs, operator shift notes, alarm history, historian data and configuration backups. A historian shows what the system reported during the window in question, but collection intervals and gaps limit what a trace can prove. Clocks are the trap: a PLC, an HMI, a historian and a domain controller often disagree by seconds or minutes, and by hours when a time zone was set wrong. We measure the offsets, state the uncertainty and build the chronology around it.
When the control room cannot agree on what the anomaly was, call (800) 868-8189 and we will start from the records rather than the theories.
Restore the Plant Without Erasing the Record
Rebuilding an engineering workstation or reloading a controller project is often the right call, and it overwrites what the compromised state looked like. Before that happens the response record captures what was preserved, which source fed the restore and who approved the change. When conditions allow, we image first; when they do not, the record says so.
Regulators, insurers and auditors ask their questions months later, and the record is built for them from the first hour: a chronology, an evidence register, an analysis of each affected system and readiness recommendations that name the log source, retention gap or missing backup owner that slowed this response down.
Planning the restoration order now? We review the restore sequence with your engineers so each system's evidence is preserved before it is rebuilt.
Methodology
Protect, Preserve, Correlate, Recover
-
Protect: Safety and Authority Boundaries
Safety, process and authority limits are set with the operator before any collection or containment begins.
-
Preserve: Volatile Evidence First
The most volatile relevant evidence is acquired first, by passive or operator approved methods, with every change the collection made recorded.
-
Correlate: One Timeline Across IT and OT
Engineering, process, network, identity and enterprise events sit on one timeline, with the measured clock offsets stated.
-
Recover: Controlled Restoration
We support the restoration sequence and keep the factual record of what changed, who approved it and which source was used.
Sites that want this sequence ready before an event sign an Incident Response SLA, which commits response times and hourly rates and keeps their network information and contacts on file.
Evidence commonly examined
Tell us which systems are affected, and the first call sets containment and preservation together.
Evidence We Review in an Industrial Incident
HMIs and engineering workstations hold the session and project history, while historians, alarms and sequence of events data show what the process reported and when. Remote access and jump host records, firewall logs and passive network captures show who reached the control network and by which path.
Controller logic and configuration backups give the baseline for comparison, and maintenance, change and operator logs separate authorized changes from the ones nobody can account for.
What you can expect
What the Response Establishes
You receive an OT incident chronology with its uncertainty stated, an evidence and operating constraint register showing what was preserved and what could not be, and an assessment of the affected assets and the pathways between them.
The response closes with remediation and readiness recommendations written for the operators who carry them out and the leaders who approve them. If your insurer, regulator or legal team has already asked for specific outputs, tell us what they asked for and we will scope the response around it.
Bring the devices, accounts and dates involved to a free first call. Start the conversation here.
A Response Record Built to Be Questioned
Our examiners have testified in federal and state courts, so an OT incident record is written for the questions it will face from a regulator, an insurer or a court. Joseph Caruso, founder, CEO and CTO, brings real time transaction systems and cybersecurity incident response to the timeline; Robert Knudsen brings eighteen years of forensic work and earlier years supporting computer and network operations in the field. Read the examiner biographies.
Frequently asked
Malicious Changes, Plant Authority and Production Continuity
Can you tell us whether a change was malicious?
We test each competing explanation, malicious change, authorized maintenance, configuration error or equipment fault, against the surviving records and report which ones the evidence supports and which it rules out. Where the record supports a firm conclusion, we state it directly.
Do you direct plant operations?
Operational decisions stay with your authorized operator. We provide the technical analysis and propose actions with the evidence behind them, and the operator decides what the plant can safely do.
Can you collect evidence without stopping production?
Often, yes. Logs, captures, historian data and project files can usually be collected passively. Operators approve every method, and where a collection would put the process at risk we document it and corroborate from safer sources.
Which framework does the response follow?
The response follows the distinctions between industrial and enterprise incident handling drawn in NIST SP 800-82 Revision 3, applied to your installed systems and operating requirements during scoping.
Can we prepare before an incident?
Yes. Readiness work identifies your log sources and retention, who owns the backups, what collection is possible on each system type and who needs to be on the call at 2 a.m. The hours that preparation saves are the hours when the evidence still exists.
An Active Event Starts With One Call
Call (800) 868-8189 and be ready to describe the affected operation, the current process condition, the changes you know about and your authorized operational contact. A responder will agree evidence priorities and safe next steps with your operators on that first call, and the first consultation is free.
Once the event is over, OT, ICS and SCADA forensics carries the preserved record into root cause analysis and any dispute that follows, and critical infrastructure and OT security hardens the plant against the next one.
Incident intake
What Happens in the First Hour After You Call
Tell us the affected operation, its current state and who holds authority on site. For an active event, call the hotline now.
Since 1992 · 24/7 dispatch · Court tested experts
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .