OT/ICS Incident Response Buyer’s Guide

What you are actually buying

An OT/ICS incident response engagement bundles three things: contracted response sequencing that respects process safety, responders who work at Purdue model levels 0 through 3 without an IT DFIR mindset bolted on, and evidence handling that survives a regulator, an insurer, and sometimes a court.

The product is not a warm body count. It is the discipline of validated action: the firm knows why an asset does what it does before isolating it, and it documents each action as it goes.

That discipline is why OT firms are a separate market from general DFIR. The directory lists firms whose OT and ICS work is documented from public sources, and records the gaps plainly when a firm documents security services but no response offering.

What to verify before the first call

Certifications with named holders. ICS security certifications (GICSP, GRID, GCIP) belong to individuals, not organizations. Ask which named responders hold which certificates and let the claims be checked against the issuer registries. A firm that resists being checked has usually never been checked.

Panel memberships, documented. Several cyber insurers publish the incident response firms on their panels, and panel membership means the carrier has vetted and keeps re-hiring the firm. Where a firm sits on a carrier-published panel, that is documented evidence. Where it does not, that is recorded too, and is not disqualifying on its own.

Documented engagements. The strongest firms publish incident write-ups and case work on their own sites. Our directory links this documented work where it exists, because it is the only public record of how a firm actually behaves during an OT incident.

Environment and platform fit. Ask which responders, not the sales team, have worked in your sector, with your asset types (PLCs, historians, safety systems), and on the detection tools you run. The RFP captures all three so firms answer in comparable form.

Why safety changes the response

In IT, containment is usually the safest move. In OT, containment can be the hazard: isolating a controller can trip a process, and a rebooted PLC can come up in an unknown state. Safety instrumented systems exist to fail safe, and a responder who does not understand your safety cases can defeat them.

This is why the questions change. Which Purdue levels are in scope. Whether the firm validates against safety cases before acting. Whether it has worked in your regulated regime, whether that is NERC CIP for electric, TSA security directives for pipelines, CFATS for chemical, or the NRC for nuclear.

A firm that answers those questions with confidence and specifics is a candidate. A firm that answers with general IT incident response language has told you something.

Retainer vs project vs on-call

A retainer fits continuous operations with regulatory exposure: pre-agreed activation, contracted response times, named contacts, and usually annual exercises that keep the engagement real. You pay for the clock being guaranteed.

A project fits scoped work: a post-incident forensic investigation, an IR plan for the plant, an architecture and segmentation review. Fixed scope, fixed timeline, no standing commitment.

On-call fits operators who need a guaranteed clock without full retainer economics. The directory records which structures each firm offers, and the RFP asks for retainer tier quotes side by side so the numbers are comparable.

The regulatory clocks

Reporting obligations do not pause while you select a firm. NERC CIP-008 gives electric entities defined incident reporting and response plan requirements. The TSA security directives give pipeline operators clock-driven requirements. CFATS and the NRC carry their own. Each one changes what evidence your firm must collect and how fast the paperwork must move.

If a reportable incident is plausible in your environment, choose the firm before the incident, and make sure the firm has worked your regime. The compliance checklist on the blog maps each framework to its incident response requirements.

Insurance panel mechanics

If you carry cyber insurance, the panel question comes first: many policies cover panel-firm response costs fully and treat off-panel work as partial reimbursement or a pre-approval step. A firm that sits on your carrier’s published panel can often bill the carrier directly under the claim.

The panel check is a filter, not a verdict. The right specialist for a chemical plant may sit on zero published panels. But when a claim will follow the incident, panel status and clean chain-of-custody practice reduce the friction between response and reimbursement, and the panel checker tool shows what we document per firm.

Evidence and chain of custody

Whatever else the engagement produces, the evidence is what your insurer, your regulator, and your post-incident review will consume. Require the firm to document what was collected, from where, by whom, and when, with hashes proving artifacts were not altered.

NIST SP 800-86 is the public reference for integrating forensic technique into incident response, and it is a reasonable standard to name in the contract. The forensic evidence article on the blog lists the six deliverables to require, from preservation and custody records through cited timelines to remediation proof.

What the structured RFP captures

The OT/ICS RFP takes about fifteen minutes and asks everything in comparable form: buyer profile and regulatory regimes, SLA tiers with onsite requirements, MITRE-style coverage areas, asset types in scope, Purdue levels, vendor platform familiarity, insurance minimums, and verification criteria including certification holders.

Firms answer in writing, against the same questions, so three proposals can be compared line by line instead of deck by deck. That comparison, plus the directory’s documented evidence per firm, is the whole point: a shortlist built on evidence survives contact with an actual incident.