OT Incident Response and Safe-State Fallback
When something goes wrong, the priority order is safe physical state first, then containment, then recovery - never the reverse.
Response ordered by consequence
IT incident response often prioritizes containment and evidence preservation. OT inverts the first step: the machine must be safe before anything else. Kronos's playbook is explicit - reach a safe physical state, then contain the cyber event, then preserve evidence, then recover. An analyst must never delay a safe shutdown to keep a forensic session alive.
The response sequence
- Safe state: the independent safety path drives the machine to safe termination if the incident touches control integrity.
- Contain: isolate affected segments per playbook, guided by anomaly detection, with control-touching isolation gated by operators.
- Preserve: the tamper-evident audit log and lineage are already captured and mirrored offsite via the diode.
- Eradicate and recover: re-provision affected nodes from signed, attested images - see resilience and recovery.
Deterministic recovery, not improvisation
Recovery re-establishes a known-good state rather than patching in place. Compromised nodes are re-flashed with signed firmware and must pass attestation before rejoining. Because credentials are short-lived, re-issuance naturally excludes nodes that cannot attest. The lineage lets responders reconstruct exactly what happened using twin replay.
Roles and authority
Consequential response actions follow separation of duties; break-glass access is available but loud and reviewed. The plan names who may authorize a shutdown, an isolation, and a recovery, so no step waits on ambiguity during an incident.
Design status: the playbook is drilled against the twin and red-team exercises. Live drills on plant hardware are FOAK-era; the organizational response team and on-call structure are defined for plant operation, not yet standing for a running reactor.