Scenario 07 / 10 · NIST SP 800-61 REV. 3

Water-system controller anomaly

A municipal water plant sees a chemical dosing setpoint change that differs from the operator's approved work order.

Fictional training scenario; no real system or person is described.

Safety and authority boundary

Put operator and public safety first; do not scan, reboot or isolate controllers before an authorized process-safety decision.

01 / 05

Preparation

GV · ID · PR

A municipal water plant sees a chemical dosing setpoint change that differs from the operator's approved work order.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Sable Evidence team	Prepared an evidence route	Named read-only sources and custodians for: The control-room screen and a local gauge disagree; the affected network path also carries other safety functions.	The first alert needs a verifiable provenance and time.
Tamar Service team	Rehearsed safe continuity	Tested an isolated version of: Return to automatic control only after engineering checks sensors, actuators and approved setpoints in a bounded test.	A rushed recovery can worsen the service impact.
Umber Decision team	Set authority and escalation	Assigned owners and approval conditions around: Put operator and public safety first; do not scan, reboot or isolate controllers before an authorized process-safety decision.	Safety, privacy and communications need accountable decisions.

02 / 05

Detection and analysis

The control-room screen and a local gauge disagree; the affected network path also carries other safety functions.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Sable Evidence team	Triaged the signal	Preserved source, UTC time and a second independent check for: The control-room screen and a local gauge disagree; the affected network path also carries other safety functions.	One alert is a lead, not proof of cause or scope.
Tamar Service team	Measured user impact	Compared the actual service with the scenario baseline: A municipal water plant sees a chemical dosing setpoint change that differs from the operator's approved work order.	Technical alerts alone do not establish operational impact.
Umber Decision team	Declared a bounded case	Recorded confirmed facts, unknowns, owner and next review time.	The teams can coordinate without overstating the evidence.

03 / 05

Response and containment

Put operator and public safety first; do not scan, reboot or isolate controllers before an authorized process-safety decision.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Sable Evidence team	Preserved and scoped evidence	Saved the original records and defined a bounded path for: Have the process operator verify safe physical readings and invoke the approved manual procedure; preserve control logs read-only.	Containment must not destroy the basis for later review.
Tamar Service team	Applied the approved control	Implemented: Have the process operator verify safe physical readings and invoke the approved manual procedure; preserve control logs read-only.	A reversible, owner-approved change reduces harm without expanding scope.
Umber Decision team	Authorized and communicated	Logged the approver, affected users and constraint: Put operator and public safety first; do not scan, reboot or isolate controllers before an authorized process-safety decision.	Response actions need clear authority and proportional notice.

04 / 05

Recovery

Return to automatic control only after engineering checks sensors, actuators and approved setpoints in a bounded test.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Sable Evidence team	Checked for persistence	Compared new telemetry against: Independent measurements match the approved process range and operators sign off the controlled return.	An apparently healthy service can still be compromised.
Tamar Service team	Restored in stages	Executed: Return to automatic control only after engineering checks sensors, actuators and approved setpoints in a bounded test.	A staged return tests dependencies before widening access.
Umber Decision team	Accepted the business outcome	Requested owner sign-off only after: Independent measurements match the approved process range and operators sign off the controlled return.	Recovery is a service decision, not merely a green dashboard.

05 / 05

Improvement

ID.IM

Rehearse a safe manual fallback and document control-room versus field-reading disagreement.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Sable Evidence team	Turned uncertainty into a test	Documented the evidence gap and proposed: Rehearse a safe manual fallback and document control-room versus field-reading disagreement.	A lesson needs a measurable future check.
Tamar Service team	Rehearsed the changed control	Assigned an owner and date to test: Rehearse a safe manual fallback and document control-room versus field-reading disagreement.	An untested action item is not a verified improvement.
Umber Decision team	Closed the decision record	Approved resources, tracked the owner and checked the new control later.	Learning must feed Govern, Identify and Protect.

Recovery acceptance test

Independent measurements match the approved process range and operators sign off the controlled return.

Improvement to verify

Rehearse a safe manual fallback and document control-room versus field-reading disagreement.