ICS/SCADA › Module 9 › Lesson 2
Reporting
OT reporting literacy names regulatory notification concepts, internal escalation, and CISA reporting channels — educational framing on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_reporting
Reporting literacy. $OT_LAB only. Original Cyberlium.
Opening
OT incidents may trigger regulatory and CISA reporting — literacy names channels; consult counsel and management for real obligations.
Reporting literacy covers internal escalation timelines, information sharing concepts (ISACs), CISA ICS reporting overview, and evidence preservation for investigations. Draft reporting checklist rows on fictional incidents — not filing false reports or claiming legal compliance from courseware. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Lessons Learned.
1. What Reporting covers (named)
Reporting literacy: internal exec notification, legal/counsel trigger, CISA reporting overview, sector ISAC concept. Educational — real obligations require counsel and management. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Write reporting checklist row — audience, trigger, information stub, owner. Fictional incident INC-LAB-001 only. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Reporting covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA reporting — https://www.cisa.gov/topics/industrial-control-systems NIST SP 800-82 — https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_INCIDENT/reporting-checklist.md" <<'EOF'
# OT Reporting Checklist — EDUCATIONAL ONLY
- Internal exec notification stub
- Legal/counsel escalation trigger
- CISA ICS reporting overview (consult counsel for real duties)
- Fictional incident: INC-LAB-001
NOT LEGAL ADVICE — educational literacy only
EOFCommand — copy this
grep -E 'EDUCATIONAL|INC-LAB|counsel' "$OT_INCIDENT/reporting-checklist.md"
Primary tools to practice this lesson: grep, python3. Reference sites: CISA reporting (https://www.cisa.gov/topics/industrial-control-systems); NIST SP 800-82 (https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Reporting matters for defenders
Early legal involvement protects victims and employees. Accurate timelines matter more than polished slides. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Students draft reporting rows on lab templates. Production follows org legal and regulatory programs. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: filing fake regulatory reports using lab fiction. Allowed: reporting literacy checklist with educational disclaimer. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: reporting checklist row. Next: Lessons Learned.
4. What you ship: reporting card for $OT_LAB
OT reporting literacy names regulatory notification concepts, internal escalation, and CISA reporting channels — educational framing. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Reporting card. $OT_LAB named. File t38-m09-l02-reporting.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Submit lab fictional incident to real regulator as hoax.
Right
Write reporting card for YOUR $OT_LAB. Next: Lessons Learned.
Mission: document Reporting on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Reporting on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Reporting literacy on Cyberlium uses:
Multiple choice