scada-hmi-incident-containmentlisted

## When to Use - Compromise indicators on an HMI: unexpected screens, unresponsive setpoint controls, unknown sessions. - Unexplained setpoint changes traced to an HMI session. - Malware alerts on an HMI host. - An operator reports the HMI behaving outside its commissioned design. ## Prerequisites - Backup HMI or a local control path that can take over visualization and manual control. - Firewall access to isolate the HMI segment from controllers. - HMI session logs and audit trail access. - Zone map showing the HMI segment and its controller connections. - Credentials: read-only for log preservation, admin on the boundary firewall for isolation. - Authorization: operations manager approves the isolation and the operator switch. Confirm the backup HMI path is live before isolating the primary. - Upstream skills: `ot-incident-triage` for the decision record. ### Safety This skill is active. Firewall isolation changes a live system and is gated in the Workflow section. - Active. Applies firewall changes to live segments. Requires operations manager approval. Process continuity is the constraint the containment works inside. ## Workflow > SAFETY: If at any point the action risks human safety or process integrity, halt and escalate to the operations lead before continuing. 1. Confirm the decision authority. The operations manager owns the operator switch and the isolation. Record name, contact, and time. 2. Preserve evidence before any change. Export the HMI session logs