FIRM-OT: A Methodology for Cybersecurity Forensics and Incident Response in OT

The increasing complexity of Operational Tech-nology (OT) systems and the rise in cyber threats demand effective approaches for Cybersecurity Forensics and Incident Response. This short paper presents the preliminary FIRM-OT methodology (Forensic and Incident Response Methodology for Operational Technology), designed to address incidents in industrial environments in compliance with IEC 62443, TISAX, and NIST standards. FIRM-OT introduces a structured and standards-aligned framework that not only covers the full inci-dent response cycle (from detection to recovery) but also uniquely integrates forensic tools and AI-driven anomaly detection mech-anisms tailored for OT environments. In a simulated industrial intrusion scenario, FIRM -OT demonstrated its ability to reduce evidence acquisition time and improve event correlation accuracy compared to conventional response workflows. Overall, this short paper contributes to OT cybersecurity by proposing an approach designed to meet recognized standards, with the added benefit of improving the effectiveness of incident response and forensic investigation across industrial systems and related technologies, such as ICS, CPS, and IoT.