13) Are OT configurations (PLC logic, SCADA settings, etc.) regularly backed up, stored securely away from the production network, and tested for restorability?
Answer yes if your organisation regularly backs up critical OT configurations and data (e.g. PLC logic, SCADA settings), stores backups securely and separately from production, and periodically tests restoration. Describe the backup and restoration testing processes in the notes or upload supporting documentation as evidence.
Configuration for OT systems can be very specific, often highly customised setup that governs how control systems are controlled, and losing it (through hardware failure, ransomware, or accidental misconfiguration) can be just as disruptive as losing the underlying hardware, sometimes more so if the original configuration was built up over years and isn't easily recreated from scratch. Backing up these configurations regularly, storing those backups securely away from the production network, and testing that they can actually be restored, addresses three distinct failure modes: not backing up at all, backing up but storing the backup somewhere it can be compromised or destroyed alongside production (such as an attacker deleting backups accessible from the same network during a ransomware incident), and backing up without ever confirming the backup would actually work if needed. Each of these gaps can turn a recoverable incident into one that causes prolonged, and potentially very costly, disruption to physical operations.
How to implement the control
Implement regular backups of critical OT configurations and data (such as PLC logic and SCADA settings), store them securely and separately from the production network, and periodically test that they restore successfully.
.svg)
