OT Tabletop Exercise: Ransomware Reaches the Plant Floor

An OT tabletop exercise rehearses a cyber incident that reaches operational technology: the control systems that run a physical process. This scenario starts with ransomware in corporate IT, follows it across an engineering workstation into the plant, and asks the question that matters most: do you stop the line before safety is at stake?

It is built for manufacturing plants, but the structure works for utilities, food processing and any site with a control room. It is an ICS incident response tabletop for operations, technical and executive players together, and it deliberately puts the plant manager, not the security team, in charge of decisions about the physical process. The process details are generic on purpose; clear authority and safe decisions are what the exercise tests.

Scenario at a glance

Exercise objectives

1. Confirm that authority over the physical process sits with the plant manager and shift supervisor, and that everyone in the response respects it.
2. Decide how and when to separate IT from OT, knowing which production functions depend on the connection.
3. Make a safety-first decision about stopping or continuing production, based on process safety criteria rather than cyber uncertainty alone.
4. Test manual and degraded operation procedures and the controls on vendor remote access during an incident.
5. Identify regulatory, customer and insurer notifications and who owns each.
6. Define the criteria and evidence required before restarting production.

Starting situation

Read this aloud to players:

Your company manufactures coated packaging materials at a single large plant running three production lines around the clock. Each line has an HMI in the control room, PLCs on the floor and a safety instrumented system that can trip the line independently of the control system. Two engineering workstations are connected to both the corporate network and the OT network so engineers can reach drawings, email and the historian.

It is Wednesday, 03:15. The night shift is running normally. The corporate IT team has one engineer on call. The plant manager is at home and on call. A key customer shipment is due to leave on Friday.

Injects timeline

Module 1 — From IT incident to plant incident (T+00:00 to T+01:00)

Inject 1. At 03:15 the corporate EDR console alerts on mass file encryption on two file servers and the ERP application server. The on-call IT engineer confirms ransom notes and calls the CISO. Nobody has yet asked whether the plant is affected.

Inject 2. The CISO wants to cut every connection between the corporate network and the plant. The OT engineer, woken by the call, warns that production orders, recipe downloads and the quality historian all flow across that link, and that the two engineering workstations are connected to both networks. Cutting the link will not stop anything already running on those workstations.

Inject 3. At 04:15 the Line 2 operator notices on the HMI that the curing oven temperature setpoint has been raised well above the normal recipe value. Nobody in the control room made the change. The actual temperature is still within limits but rising slowly.

Discussion questions:

• At what point does the plant need to know about an IT ransomware incident? Who tells the shift supervisor?
• Who has the authority to separate IT from OT? What stops working in production if you do, and who knows that list?
• What does the operator do first when a setpoint changes without explanation? Is that written down?
• How much do you trust the HMI right now? What independent readings or field checks are available?

Module 2 — Safety, containment and manual operation (T+01:20 to T+04:00)

Inject 4. The shift supervisor calls the plant manager: "I've reset the setpoint and it's holding, but I don't know who changed it or whether it'll happen again. Do I stop Line 2, stop everything, or keep running with someone watching the oven?" A controlled shutdown of a line takes about 40 minutes; an emergency stop risks damaged product and equipment.

Inject 5. The IR lead and OT engineer review workstation logs. At 03:52, a remote desktop session was opened to engineering workstation EWS-01 using a domain account belonging to a process engineer, through the remote access tool the automation vendor uses for support. The engineer is on leave and says they did not log in.

Inject 6. At 05:10 a PLC on Line 1 restarts unexpectedly and comes back in a fault state. Operators move the line to manual control. The shift has enough staff to run one line manually, not three.

Discussion questions:

• Who makes the call to stop production, and on what criteria? Does cyber uncertainty alone justify stopping, or only a safety concern?
• Does the safety instrumented system give you confidence, and has anyone confirmed it is unaffected and independent?
• How do you contain an attacker in OT without creating a hazard? Is shutting down EWS-01 safe? Disconnecting it?
• Who disables the vendor remote access tool, and what else depends on it?
• How long can you run manually, with which staff, and who decides which lines to keep running?

Module 3 — Partners, obligations and restart (T+08:00 to T+36:00)

Inject 7. The automation integrator hears about the incident and offers to connect remotely to check the PLCs and HMIs. At the same time, the key customer's supply manager calls to ask whether Friday's shipment is at risk and whether your products could have been affected.

Inject 8. Legal and the HSE manager ask for a list of who must be notified. Candidates include the national cybersecurity authority (if the plant falls under national NIS2 rules, an early warning is due within 24 hours of becoming aware of a significant incident), any safety or environmental regulator if a process deviation must be reported, the cyber insurer, customers under contract, and the police.

Inject 9. Thirty-six hours in, IT has restored the ERP from backup and rebuilt the domain controllers. The COO asks the plant manager when all three lines can restart. The OT engineer says the controller logic on Line 1 has not yet been compared with the known-good version, and nobody is sure whether other setpoints were changed.

Discussion questions:

• Do you let the integrator connect remotely now? Under what conditions, or do you ask them to come on site?
• What do you tell the customer about product quality and delivery? Who approves it?
• Which notifications apply to your sector and country? Who owns each, and when does each clock start?
• What must be true before restarting each line: verified controller logic, verified setpoints, clean engineering workstations, tested safety systems? Who signs off?
• Who has the final word on restart if production and the plant manager disagree?

Discussion questions

Consolidated themes for the hotwash:

• Authority: Was it clear that the plant manager owned decisions about the physical process? Did anyone try to override that?
• Segmentation: Did the team know every path between IT and OT? Why were engineering workstations dual-homed, and what should replace them?
• Safety first: Were decisions to stop or continue based on process safety criteria, and were they recorded with reasoning?
• Vendor access: Who controls remote access into OT, and can it be switched off quickly without breaking something else?
• Restart: Are restart criteria written down before an incident, or invented under commercial pressure? See the supply chain compromise scenario for related vendor questions.

Curveballs / optional injects

Use one or two if the group is moving quickly:

• The historian shows the setpoint never changed, contradicting the HMI and the operator.
• An operator is slightly injured while running Line 1 manually, and HSE must investigate.
• The attacker's ransom note mentions the plant by name and claims to have control of the lines.
• Backup copies of PLC logic are stored only on the compromised engineering workstation.

Facilitator notes

Expected decisions. A well-prepared team brings the plant into the response within the first hour, separates IT from OT with a named decision-maker who understands the production dependencies, and treats the unexplained setpoint change as a safety event first. The plant manager makes a recorded decision to bring Line 2 to a controlled stop, disables vendor remote access, avoids actions on OT assets that could create a hazard, and sets restart criteria that include verification of controller logic and setpoints, with a clear sign-off.

Common pitfalls.

• Treating the incident as an IT problem until something happens on the plant floor.
• Security staff issuing instructions to operators, or IT isolating networks without knowing what production depends on.
• Stopping everything in a panic with an emergency stop, or refusing to stop anything for commercial reasons.
• Letting the vendor connect remotely during the incident because it is the fastest way to get help.
• Restarting under customer pressure without verifying logic and setpoints.

Adapting the audience. For an executive session, summarise Module 1 and focus on injects 4, 7, 8 and 9: authority, customer commitments, notifications and restart. For a technical session, expand Module 2 with detail on network architecture, workstation forensics and PLC logic comparison, and add the backup curveball. If your site has a different process, replace the oven with your own critical process variable and ask your process safety lead to check the injects. You can run this industrial cybersecurity exercise live with the exercise runner, which delivers injects to players' phones and records decisions.

Evaluating the exercise

Related

• Ransomware tabletop scenario
• Supply chain compromise scenario
• NIS2 and DORA tabletop exercises
• Tabletop exercise roles
• Glossary: incident commander, white cell, playbook