What is the first step in incident recovery for a damaged control network segment?

What is the first step in incident recovery for a damaged control network segment?

• A. Restore from clean backups.
• B. Isolate the affected segment.
• C. Verify system integrity.
• D. Re-establish secure communications.

Answer: (B)

Isolating the affected segment is the first action because containment stops the incident from spreading and protects safety-critical operations. By separating the damaged portion from the rest of the control network, you prevent lateral movement, limit impact, and preserve evidence for investigation. Once the segment is cut off, you can safely assess integrity, clean or replace compromised equipment, restore from clean backups, and re-establish secure communications without reintroducing the threat. Restoring or rejoining systems before containment can allow the attacker to spread or re-enter, making the recovery task much harder.

Isolating the affected segment is the first action because containment stops the incident from spreading and protects safety-critical operations. By separating the damaged portion from the rest of the control network, you prevent lateral movement, limit impact, and preserve evidence for investigation. Once the segment is cut off, you can safely assess integrity, clean or replace compromised equipment, restore from clean backups, and re-establish secure communications without reintroducing the threat. Restoring or rejoining systems before containment can allow the attacker to spread or re-enter, making the recovery task much harder.