What steps can you take to develop an effective disaster recovery plan for industrial control systems?

From my experience: 1- Start with a meticulous risk assessment, pinpointing vulnerabilities. 2- Craft a detailed blueprint, integrating business impact analysis and precise recovery objectives. 3- Prioritize data integrity and system resilience, ensuring regular backups and redundant systems. 4- Emphasize rigorous testing and continuous refinement, fostering a culture of preparedness. This approach would guarantee a swift, effective response, safeguarding operational continuity against unforeseen disruptions.

Understand your risks by evaluating processes, criticality and dependences. What signals trip the process? Signals will show processes parameters , but also dependences on power, air, HVAC, etc What system failures trip the system? Instruments/process air, feedwater, vacuum system, MCCs etc.. How long can the process continue with important systems failed? Systems as make-up water, chemistry dosing etc will not trip but won't allow you to continue more than some hours or days, but if disregarded, it can take much more to recover All the above, think of risks 360, from fire to power outage and cybersecurity... And a power fail on cybersecurity controls can mean an increase of cybersecurity threat

Remember that for industrial controls, we're talking about a systems-of-systems approach to BC/DR. That means your RTO and RPO should consider how these systems operate with one another. In my experience, this will always include discussions around criticality and safety-- but those two alone in a silo will not answer the key questions around minimal visibility or isolated control at your facility or site. Also, understand that "data" here should include baseline configurations for devices (where possible) and could include lab data for certain environments. This requires multiple stakeholders to be involved to ultimately make a successful industrial business continuity and disaster recovery plan.

Disaster recovery in industrial plants might be disaster mitigation in many situations. Very probably that you will not find the difference alone, you need to start by putting together all leaders of disciplines. Imagine that you have the charge of building data DRP but the teams alerts that consequences of losing some systems can go against the safety of the process or against the environment or even cause deaths. You will need to look wide and long so that all leaders understand the priorities and are able to transmit to you so that you are able to gather all relevant information and stablish objectives and priorities

1. Start by defining roles and responsibilities. Enumeration, givent that Industrial Systems are Systems-of-Systems, so there are multiple responsibles of systems to involve, both from operations, maintenance, engineering and, depending on the criticality of the process, emergency response. Each one will be on 1st line, 2nd of backup. 2. Identify kinds of scenarios, the most impactful and the most likely 3. Draw Flow-diagrams with actions and responsibles sequentially 4. Go with the wording 5. Circulate around the people involve in previous stage to asure all inputs where taken properly

DR is a team effort and it can’t succeed without practice. If you want people from around your organisation to be willing to dedicate the necessary time and resources to preparing for a disaster, you have to get buy-in from C-suite leaders. All relevant people in the scope of DR should be involved considering all roles and responsibilities. Including appropiate people is key for the success and also identify appropiate testing training and periodical simulations even changing roles so people can put in some other shoes.

DR drills are essential. Start by systems with same responsibles and when you think they are prepared at minimum level (minimum procedures, backups, key people identified), test a full scope drill involving operations, maintenance, engineering but also IT, comms and cybersecurity. More or less depts will depend on objectives for DR (cybersecurity, environmental, fire, etc)

Conduct a gap analysis to compare present staff knowledge and abilities to required competencies in responding to different crisis situations. Define specific, measurable learning outcomes based on the needs identified. To accommodate varied learning styles and preferences, use a combination of classroom instruction, simulations, workshops, and online courses. Customize the information for your specific ICS environment, including pertinent case studies, equipment procedures, and recovery plans. Involve stakeholders. Collaborate with IT, operations, and management to ensure alignment with the overall disaster recovery strategy and resource allocation.

I'm going to stress asset management. If you don't know what you have, you can't access risks accurately. As mentioned, OT is " systems in systems" thus the risks are various, but the habit is to have a mix of obsolescence and new, and not to know the status of everything. Thus, walk down and know your architecture and assets.