Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Digital Forensics and Incident Response (DFIR) Framework for Operational Technology (OT)

Published

Author(s)

Eran Salfati, Michael Pease

Abstract

This document provides a new Incident Handling framework dedicated to Operational Technology. This framework expands the traditional technical steps by giving an Incident Response procedure based on the event escalation and provides techniques for OT Digital Forensics. It includes an overview with general terms explanation and a list of unique properties of OT DFIR, the preparation that should be done to establish an OT Incident Response Team, and finally, the suggested OT Incident Handling framework in detail.
Citation
NIST Interagency/Internal Report (NISTIR) - 8428
Report Number
8428

Keywords

Active Defense, Digital Forensics, Incident Handling, Incident Response, Industrial Control Systems, Operational Technology

Citation

Salfati, E. and Pease, M. (2022), Digital Forensics and Incident Response (DFIR) Framework for Operational Technology (OT), NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8428, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=934922 (Accessed October 15, 2024)

Issues

If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.

Created June 22, 2022, Updated November 29, 2022