Backup and recovery for OT assets

Recovery is a plan, not a backup job

CIP-009 asks for recovery plans for BES Cyber Systems: the conditions that trigger them, the roles involved, how information needed for recovery is backed up and stored, how backups are verified, and how data is preserved for analysis.

What to back up

• Device configurations — firewalls, switches, relays, RTACs, controllers — after every approved change.
• System images or rebuild procedures for HMIs, engineering workstations and servers.
• Application project files and licenses needed to restore control logic.
• The documentation people will need under pressure: network diagrams, IP plans, passwords held in a secure vault.

Store it where an incident cannot reach

• Keep at least one copy offline or in a separate security zone.
• Protect backups as BES Cyber System Information: access control and integrity checks.
• Record what each backup contains and when it was taken.

Test it

Exercise the plan at least once every 15 calendar months (operational exercise, tabletop or actual recovery), and test a representative sample of backups so you know they restore. High-impact systems also need an operational exercise of the plan at least once every 36 calendar months. Within 90 days of a test or an actual recovery, update the plan with lessons learned and tell the people affected.