140 Handbook of SCADA/Control Systems Security
should address operating system restoration and verication before the application
and its data are recovered. The procedures should also include escalation steps and
instructions to coordinate with other teams where relevant when certain situations
occur, such as
• An action is not completed within the expected time frame.
• A key step has been completed.
• Item(s) must be procured.
• Other system-specic concerns exist.
If conditions require the system to be recovered at an alternate site, certain mate-
rials will need to be transferred or procured. These items may include shipment
of data backup media from offsite storage, hardware, copies of the recovery plan,
and software programs. Procedur ...