Safety outranks containment
Every response decision gets weighed against process safety first. The labs teach you to make that call explicitly, and to document why.
ICS & OT Incident Management Training
Practise the incident before it happens.
Reading about incident command doesn't prepare you to run one at 3 a.m. with production down and a safety system in an unknown state. The Academy gives you the exercises, forms, and command structures to rehearse it first — built for plants, not for corporate IT.
The problem
IT playbooks break on the plant floor
"Isolate the host" is sound advice until the host is a controller holding a furnace at temperature. OT incident response has constraints IT frameworks never had to account for — and most training ignores them.
Downtime is the incident
In OT, the outage caused by your response is often worse than the intrusion. Practise recovery sequencing where RTO and MTD carry real cost.
Two organisations, one incident
Control room, plant management, corporate SOC, and regulators all need different information at different times. Build the comms matrix before you need it.
How you learn
Labs, not lecture videos
Each lab is an interactive tool you work in, producing something you keep — a command structure, an IAP packet, a comms matrix, a walk-through record. Three are free and always will be.
ICS Roles Tree
FreeBuild a command structure for an OT incident. Assign sections, inspect each role's responsibilities, export to Excel.
ICS Forms in Action
FreeMap ICS forms across the incident lifecycle and assemble a working IAP packet as you go.
DR/BC Timeline
FreeSet RPO, RTO, WRT, and MTD against a disruption and watch the recovery window play out. Save incidents, export CSV.
Exercise Simulator
MemberRun a full tabletop or functional exercise with a live clock, timed injects, role assignment, and an automatically generated hotwash report.
St. Paul 2025 Case Study
MemberWalk a real municipal cyberattack through every EOC phase. Compare your decisions against what actually happened.
OT-Specific IRP Builder
MemberProduce an incident response plan that respects safety and production continuity — roles, decision gates, containment, recovery.
The path
From framework to certificate
The order matters here — each stage assumes the one before it.
-
Learn the framework
Incident command adapted for industrial environments: sections, roles, and the forms that hold it together.
-
Build your artifacts
Work through the labs to produce a command structure, comms matrix, and IRP for your own site.
-
Run an exercise
Use the simulator to run a tabletop with your team, with injects timed against a live clock.
-
Earn the certificate
Complete the assessment and receive a verifiable certificate with a public verification URL.
Training use only
These labs are built for education, simulation, and skill development. Treat anything you produce here as a draft to be reviewed by your own safety and engineering functions before it informs live operations.