RES-01 · Respond

Cyber security incident planning

Operational technology actions

• Action 1

  Update business and operational continuity plans to reflect the impact that isolation will have on business and operational processes.

  • Every phaseVisibility and response
  Rate this action in the Navigator →
• Action 2

  Use documented, tested and approved OT incident response procedures when responding to cyber security incidents, covering situations such as safety events, setting out who participates in response and recovery, including third parties, loss of visibility, and workstation compromise.

  • Every phaseVisibility and response
  Rate this action in the Navigator →
• Action 3

  Establish and maintain a document management capability for system documentation, and retain per-site copies of playbooks, drawings, installation, reset and configuration instructions, break-glass secrets and keys, and emergency contact information in a form that does not depend on the systems being recovered.

  • Every phaseVisibility and response
  Rate this action in the Navigator →

Open the Navigator →

More Respond principles

• RES-02Cyber security incident reporting
• RES-03Cyber security incident response
• RES-04Cyber security incident insights
• RES-05Cyber security incident coordination

Source: ASD Essentials for operational technology, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.