Lol, preventative measures in this case are dumb as crap in the sense of they should be more
"This is an extremely locked down industrial device that only executes signed code and has every port on the machine epoxied over" as just the starting paragraph.
Unfortunately the exact details of what to do in a cyber incident are really closer to a per system plan. Honestly it's something that should be red teamed/blue teamed in a simulator many times, then dump some harbor pilots and captains in the sim against the red team to see what the common default reactions are.
"This is an extremely locked down industrial device that only executes signed code and has every port on the machine epoxied over" as just the starting paragraph.
Unfortunately the exact details of what to do in a cyber incident are really closer to a per system plan. Honestly it's something that should be red teamed/blue teamed in a simulator many times, then dump some harbor pilots and captains in the sim against the red team to see what the common default reactions are.