Chapter 26 — OT, IoT and cyber-physical security: operational handoff
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Projects end, systems continue"]
N2["26.2 Reading the check"]
N3["26.3 Sign-off"]
N4["26.4 Hypercare"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Projects end, systems continue"]
N2["26.2 Reading the check"]
N3["26.3 Sign-off"]
N4["26.4 Hypercare"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Projects end, systems continue]
|
v
[26.2 Reading the check]
|
v
[26.3 Sign-off]
|
v
[26.4 Hypercare]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) define what a security improvement must hand over to operations; (2) check a handoff package for completeness; (3) transfer ownership with sign-off; and (4) plan the first months after handoff.
26.1 Projects end, systems continue
The firewall changes, monitoring and contractor pack only protect NCS if someone operates them after the project team leaves. A handoff transfers knowledge, documents and responsibility from the project to the people who run the site day to day.
"""Lab 26: check a synthetic operational handoff package for required items."""
REQUIRED = ["asset list", "flow matrix", "runbook", "contacts", "backup location", "open risks", "restore test date"]
package = {"asset list": "v3", "flow matrix": "v2", "runbook": "v1", "contacts": "", "backup location": "NAS-OT/backups", "open risks": "3 items"}
missing = [r for r in REQUIRED if not package.get(r)]
print(f"present {len(REQUIRED)-len(missing)}/{len(REQUIRED)}; missing: {missing}")
print("handoff", "BLOCKED" if missing else "ready")
Run with python3 lab_handoff.py. Verified output:
present 5/7; missing: ['contacts', 'restore test date']
handoff BLOCKED
At NCS the receiving owner is the facilities manager, and the people running it are the night operators who will see the alerts first.
Priya's handoff checklist has seven items; the first run found five present and marked the handoff BLOCKED.
26.2 Reading the check
The package lacks contacts and a restore-test date. Missing contacts mean that at 3 a.m. nobody knows whom to call for the jump host or the logger vendor. Missing restore evidence means the backup in the package might not work. Both block handoff because each one fails exactly when the site needs it.
Priya fixed both before sign-off: she added a contacts sheet listing the approver rota, contractor, logger vendor, internet provider and security lead, and restored HIST into an isolated VM, recording 2026-10-09 as the test date. The rerun showed 7/7 items present.
26.3 Sign-off
The receiving owner — the facilities manager — signs that they understand each item and accept responsibility. Sign-off without a walkthrough is a signature, not a handoff; walk through the runbook together and let the operator perform one task while you watch.
Priya's walkthrough with the night operator found what a document review had missed: the runbook referred to a menu that the HMI vendor had renamed. The step was corrected before sign-off. That single correction would have cost a confused operator many minutes during a real alert, at an hour when nobody from the project team would answer the phone.
26.4 Hypercare
For the first four weeks, the project team remains on call, reviews alerts with operations weekly and fixes documentation gaps found in real use. Then responsibility moves fully to the site.
At NCS the four weeks would cover at least one contractor visit, so the visit pack, the jump-host approval and the new-talker link are all exercised once in real use. Weekly reviews look at the drift checker's report and the certificate tickets with the facilities manager. Gaps found go into the runbook the same week, and the end of hypercare is recorded in the handoff file with the list of corrections made.
Worked example (synthetic NCS)
Priya adds the contacts sheet (approver rota, contractor, logger vendor, internet provider, security lead) and performs a restore test of HIST into an isolated VM, recording 2026-10-09 as the date. The rerun shows 7/7 items present. During the walkthrough, the night operator finds that the runbook refers to a menu that the HMI vendor renamed; the step is corrected before sign-off.
Synthetic case — Northgate Cold Storage. The package contents are invented.
Errors and limits
A complete checklist does not prove quality; the walkthrough does. Contacts go stale quickly; give them a review date.
Exercises
- EX076 — After adding contacts only. If only
"contacts": "sheet v1"is added, what does the lab print? Rubric: 3 = present 6/7, missing restore test date, BLOCKED; 2 = one line right; 1 = ready; 0 = none. - EX077 — Why contacts block handoff. Explain in one sentence. Rubric: 3 = in an incident nobody knows whom to call; failure at the critical moment; 2 = partial; 1 = vague; 0 = none.
- EX078 — Designing a walkthrough task. Choose one task the operator should perform during the walkthrough and justify it. Rubric: 3 = specific, frequent or critical task (approve contractor session/check alert); 2 = task only; 1 = read the document; 0 = none.
Synthesis
A handoff is complete when the package is whole, the owner has walked through it and signed, and a short hypercare period has caught what documents missed.
Continue studying — chapter 26 of 30
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →