I85PREP
⌘ K
Lead SCADA Security Manager study materials
Lead SCADA Security Manager study resources

Lead SCADA Security Manager: Continuity, Resilience, and Recovery

Lead SCADA Security Manager · Work through your exam, one topic at a time.

All guide sections

Continuity, Resilience, and Recovery

This domain tests whether you can keep SCADA operations running through disruption and recover safely. Expect questions on business impact analysis, RTO/RPO, backups, disaster recovery, incident response, manual operations, and exercise validation.

Core rules

  • Start with a business impact analysis for each critical process. Define maximum tolerable downtime, recovery time objective (RTO), and recovery point objective (RPO) with operations, not IT alone.
  • Design resilience through redundancy, diverse paths, spare hardware, and vendor support agreements. Confirm that failover preserves safety and control semantics.
  • Back up configurations and historians using offline or immutable copies; follow a 3-2-1 pattern and keep at least one copy isolated from the control network.
  • Test restoration, not just backup completion. A backup that has never been restored is a hypothesis.
  • Maintain manual-operation procedures for loss of SCADA, and exercise them in tabletop and functional tests.
  • Integrate cyber incident response with continuity: containment may require isolating a zone, which can trigger manual operations.

Worked example

A historian has an RTO of 4 hours and an RPO of 15 minutes. Reasoning: use continuous replication to a segmented server plus an offline immutable backup. Test a full restore quarterly, measure actual restore time against 4 hours, and verify the recovered data is within 15 minutes of the loss point. Document a manual logging procedure for the interval and confirm operators are trained to use it.

Traps that cost marks

  • Reporting backup success while never testing restoration or measuring restore time.
  • Assuming a DR site has the same OT software licenses, configurations, and vendor support.
  • Treating a cyber incident as purely an IT event rather than a continuity event.

Key points

  • BIA defines maximum tolerable downtime, RTO, and RPO with operations.
  • Resilience needs redundancy, spares, and validated vendor support.
  • Backups should include offline or immutable copies isolated from OT.
  • Restoration must be tested and timed against RTO.
  • Manual operating procedures are a continuity control.
  • Cyber containment decisions can trigger continuity plans.