# Safety-led industrial incident response

Do not blindly transfer IT isolation reflexes to OT. Keep process authority, physical impact, communications and evidence visible in the same decision.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## First question: who has authority?

Harbor receives a suspicious-access record while line state remains uncertain. The SOC reports the incident but does not alone control physical operations. Activate predefined site operations, safety, engineering and incident-lead roles. An immediate physical hazard is governed by existing site emergency procedures and authorized personnel; this lesson invents no shutdown step. Record communication chains, alternative channels and shift handover. Neither ignoring physical risk pending perfect cyber certainty nor issuing a generic outage instruction from an uncertain cyber record is a sound approach. The task is to make authority and uncertainty explicit.

## Evaluate containment through its effects

Disconnecting a link, rebooting or triggering automatic agent response can have unexpected consequences for a particular process. Authorized teams assess dependencies and the proposed action’s effect. Harbor applies no action; it asks for documented scope, site authority and fallback planning. It also asks which other functions could be affected by interrupting a shared gateway. The appropriate decision depends on site and incident state; there is no universal disconnect-all rule. Model output concerns evidence sufficiency only and does not select a real containment action or determine a safe process state.

## Preserve evidence with process context

Evidence collection can alter system load or access requirements. Record source, collection authority, time uncertainty, scope and process state. Do not try arbitrary controller commands to compensate for missing logs. Incident and site teams assess evidence needs alongside operating constraints. Harbor workpapers preserve the distinction between observation, claim and an authorized action actually taken. A matching hash alone does not establish origin or legal admissibility. Do not put real personal data, sensitive architecture or secrets into the learning page. The local exercise acquires no raw evidence or industrial-system data.

## Handover and closure

A response log records decision owner, rationale, source references, time and open questions. The incoming shift must distinguish confirmed information from remaining assumptions. Restored availability is not process or safety acceptance; separate recovery checks apply. Reporting duties and external communications are assessed through the organization’s authorized legal and communications process; this example calculates no statutory deadline. Closure tracks recurring causes, corrective work, ownership and verification dates. A learner’s choice creates neither an actual incident record nor a professional competency credential; it demonstrates reasoning about a fictional situation.

## Working sequence

1. Identify incident and site authority roles.
2. Confirm process context with authorized personnel.
3. Review effects and scope of the proposed action.
4. Record evidence, communications and handover.
5. Hand over open risks to authorized owners.

## 1. Can the SOC decide alone?

Declaring an incident does not transfer process authority. Operator input, safety authority and action scope are required for site decisions; this model controls no equipment.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.incidentDeclared === true
```

### Corrected implementation
```js
s => s.incidentDeclared === true &&
  s.operatorConsulted === true &&
  s.safetyAuthority === true &&
  s.actionScoped === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "incidentDeclared": true,
        "operatorConsulted": true,
        "safetyAuthority": true,
        "actionScoped": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-operatorConsulted",
      "input": {
        "incidentDeclared": true,
        "operatorConsulted": false,
        "safetyAuthority": true,
        "actionScoped": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-safetyAuthority",
      "input": {
        "incidentDeclared": true,
        "operatorConsulted": true,
        "safetyAuthority": false,
        "actionScoped": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "incidentDeclared": true,
        "operatorConsulted": true,
        "safetyAuthority": true,
        "actionScoped": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-operatorConsulted",
      "input": {
        "incidentDeclared": true,
        "operatorConsulted": false,
        "safetyAuthority": true,
        "actionScoped": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-safetyAuthority",
      "input": {
        "incidentDeclared": true,
        "operatorConsulted": true,
        "safetyAuthority": false,
        "actionScoped": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Disconnect immediately?

A proposed action is not evidence of suitability. Do not transfer a generic IT isolation reflex to production without physical-impact review, site authority and fallback planning.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.actionProposed === true
```

### Corrected implementation
```js
s => s.actionProposed === true &&
  s.physicalImpactReviewed === true &&
  s.siteAuthorized === true &&
  s.fallbackReady === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "actionProposed": true,
        "physicalImpactReviewed": true,
        "siteAuthorized": true,
        "fallbackReady": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-physicalImpactReviewed",
      "input": {
        "actionProposed": true,
        "physicalImpactReviewed": false,
        "siteAuthorized": true,
        "fallbackReady": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-fallbackReady",
      "input": {
        "actionProposed": true,
        "physicalImpactReviewed": true,
        "siteAuthorized": true,
        "fallbackReady": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "actionProposed": true,
        "physicalImpactReviewed": true,
        "siteAuthorized": true,
        "fallbackReady": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-physicalImpactReviewed",
      "input": {
        "actionProposed": true,
        "physicalImpactReviewed": false,
        "siteAuthorized": true,
        "fallbackReady": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-fallbackReady",
      "input": {
        "actionProposed": true,
        "physicalImpactReviewed": true,
        "siteAuthorized": true,
        "fallbackReady": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Are copied logs sufficient?

Copied logs lack context without collection authority and process state. Record time uncertainty too; file existence establishes neither truth nor admissibility of evidence.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.logsCopied === true
```

### Corrected implementation
```js
s => s.logsCopied === true &&
  s.collectionAuthorized === true &&
  s.timeUncertainty === true &&
  s.processContext === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "logsCopied": true,
        "collectionAuthorized": true,
        "timeUncertainty": true,
        "processContext": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-collectionAuthorized",
      "input": {
        "logsCopied": true,
        "collectionAuthorized": false,
        "timeUncertainty": true,
        "processContext": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-processContext",
      "input": {
        "logsCopied": true,
        "collectionAuthorized": true,
        "timeUncertainty": true,
        "processContext": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "logsCopied": true,
        "collectionAuthorized": true,
        "timeUncertainty": true,
        "processContext": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-collectionAuthorized",
      "input": {
        "logsCopied": true,
        "collectionAuthorized": false,
        "timeUncertainty": true,
        "processContext": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-processContext",
      "input": {
        "logsCopied": true,
        "collectionAuthorized": true,
        "timeUncertainty": true,
        "processContext": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Response decision log with authority and impact fields.
- Time, source, uncertainty and shift-handover record.

## References

- [NIST SP 800-82 Rev.3 · Final September 2023](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [NCSC and partners · Maintaining a definitive view of OT architecture · October 2025](https://www.cyber.gov.au/sites/default/files/2025-10/ncsc-creating-and-maintaining-a-definitive-view-of-your-operational-technology-architecture.pdf)