ot-incident-response-plan-reviewlisted

## When to Use - Reviewing an OT incident response plan against a recognized structure. - After an incident, to review whether the plan matched what responders actually needed. - Before an exercise, to confirm the plan covers the scenarios being tested. - Integrating an OT plan with the enterprise IR plan. ## Prerequisites - The current OT incident response plan and any linked playbooks. - The enterprise IR plan, for the integration review. - Incident records from the last 24 months, where they exist. - Contact list with dates of last verification. - Credentials: none. This skill produces assessment documents. - Authorization: the plan owner and operations manager accept the review findings. - Upstream skills: `ot-incident-triage` for the decision structure the plan should match. ### Safety This skill is passive. It produces assessment and governance documents only. ## Workflow 1. Review the plan structure against the four phases. Requirement: the plan covers the full lifecycle. Anchor: NIST SP 800-61 phases. Decision: Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity each have a named section with actionable content. Trade-off accepted: a plan written in phase order reads well and is hard to use at 03:00. The fix is playbooks, not a rewrite. Flag both. 2. Review the decision authority. Requirement: the plan names who decides. Anchor: IR-1. Decision: for each incident class, the plan names the decision authority for