Introduction

Here is something most people learn the hard way: most of the work on an OT incident response plan is not the writing. It happens before the first chapter and after the last one. A senior sponsor, the right team, the interviews across every shift, the approval and the upkeep decide whether anyone ever uses the plan. The writing sits in the middle.

You are probably reading this because someone handed you the job. Maybe your site has an IT incident response plan that says nothing about the plant. Maybe there is an old OT plan on a shelf that nobody on shift has read. Either way, the usual first move is to download a template, fill in the blanks and get it signed. Then an alarm comes in at night, and the operator on shift has never seen the plan. Templates are easy to find. The method behind a plan that works is not: who sponsors it and who writes it, what it says about safe states and shutdown authority, and how it stays current as the plant changes.

Three Answers Your Plan Will Give

By the end of this book, your plan will answer three questions most plans dodge. Who decides? What do the people on shift do in the first hour? And when is the plant safe to restart? You build the plan one chapter at a time, in an order that follows how those decisions depend on each other, and every chapter of this book fills one chapter of a real plan template. Each one shows the worksheets filled in for Cedar Ridge, an illustrative water treatment plant, so you can see what a finished answer looks like before you write your own. The Cedar Ridge numbers are illustrative: borrow the structure, not the figures.

Three real incidents run through the book, each testing the worksheets in the chapter where it appears. Jaguar Land Rover in 2025 shows how one incident can stop a whole supply chain. The 2022 attack on Kojima Industries, a Toyota supplier, shows how someone else's incident can trigger your plan. And Clorox in 2023 shows why an outsourced helpdesk belongs in your response.

How to Use This Book

The plan template at the center of this book has eight chapters, a regulatory compliance annex and five appendices. Appendix A lists the templates and worksheets, with a link to download them as printable PDFs and editable Word and Excel files, together with the filled Cedar Ridge examples. Keep your copy of the template open and fill in each chapter while the topic is fresh, because later chapters reuse the reference numbers and decisions from earlier ones. Appendix B lists the free public guides and templates the chapters mention.

Every chapter ends with a table of the standards, laws and guidance it relies on: who each one applies to, what it asks of that part of the plan, and its status when this book was checked in October 2026. Rules change, so check the current version of any regulation before your plan relies on it. Nothing in this book is legal advice. If you already know a topic, skim the chapter, but still fill in the worksheet; the worksheets are what turn reading into a plan.

The book stops where testing begins. It hands your plan to testing in Chapter 8 and says what must be tested and by when, but how to design and run exercises is a separate discipline. Everything before that point is here.

What's Next

Chapter 1 starts where most plans go wrong: before anyone writes a word. It sets up the plan as a project, with a policy, a charter, a sponsor and a team, and lists the rules your plan must satisfy.