--- title: ICS4ICS Exercises | Benefits, Materials, Past Exercises | ICS4ICS Team description: ICS4ICS Exercises allow participants to understand the value of ICS4ICS by showing how the ICS4ICS team manages many aspects of a cyber incident. --- [Skip to content](https://www.ics4ics.org/exercises#main-content) # ICS4ICS Exercises ICS4ICS exercises allow participants to understand the value of ICS4ICS by showing how the ICS4ICS team manages many aspects of a cyber incident. ## Benefits of ICS4ICS Exercises - Expedited resolution of cyber incidents by providing effective management processes - Establish the Incident Commander as the final authority to make decisions - Provide clear roles and responsibilities of all ICS4ICS Team members - Ensure all cyber incident staff are performing their work based on the same set of orders - Allow the various teams to focus on their work to resolve the incident while receiving periodic directions from the ICS4ICS Team ### IN THE SPOTLIGHT: Be sure to watch this month's recommended complimentary, recorded ICS4ICS lecture: STAFFING A CYBER INCIDENT RESPONSE & ICS4ICS TEAMS *In this lecture, you will learn to identify the type of cyber incidents that may impact your organization and associated staffing challenges. Learn staffing alternatives your organization can use to ensure you manage cyber incidents. * [ Click to Watch Lecture ](https://register.gotowebinar.com/recording/2033736317758342231?hsCtaAttrib=188389755245) [ Download Resources ](https://www.ics4ics.org/staffingandworkforce?hsLang=en) ***"ICS4ICS helped us validate our Incident Command System knowledge by running an exercise that helped us identify gaps in our incident response plan. Most importantly, it brought together our IT, Control Systems Group, and ERT to work collaboratively." *** - Durgesh Kalya, OT Network Security Expert ## ICS4ICS Exercise Materials ### ICS4ICS videos Demonstrates an overview of how the ICS4ICS team works together. [**Watch Virtual Exercise Video **](https://youtu.be/R7JS40uqYoQ) ### NIMS/ICS Forms Used during the ICS4ICS exercise or an actual cyber incident [**View Forms **](https://training.fema.gov/emiweb/is/icsresource/icsforms/) ### ICS4ICS Exercise Presentation Presentation used to lead an in-person or virtual exercise with players acting out the various roles OR show videos of recorded players **View Presentation (coming soon)** ### ICS4ICS Exercise Hosting Guide [View Guide ](https://www.ics4ics.org/hubfs/ICS4ICS_Exercise_Hosting_Guide.docx?hsLang=en) **If you need help with an ICS4ICS exercise, contact [ics4ics@isa.org](mailto:ics4ics@isa.org)** ![Cyber Image](https://www.ics4ics.org/hubfs/Cyber%20Image.jpg) ## FEMA and Other Exercise Materials ##### The ICS4ICS exercise materials were developed based on: - FEMA provided [exercise](https://www.fema.gov/emergency-managers/national-preparedness/exercises) overview information - FEMA ICS resource center information: [ICS resource center (fema.gov)](https://training.fema.gov/emiweb/is/icsresource/) - [FEMA Homeland Security Exercise Evaluation Program (HSEEP)](https://preptoolkit.fema.gov/web/hseep-resources) - [FEMA exercise evaluation guides](https://preptoolkit.fema.gov/web/hseep-resources/eegs) - [CISA tabletop exercise package](https://www.cisa.gov/publication/cisa-tabletop-exercise-package) - [FEMA ICS forms ](https://training.fema.gov/icsresource/icsforms.aspx)can be download together: [NIMS ICS forms booklet](https://training.fema.gov/EMIWeb/IS/ICSResource/assets/NIMS%20ICS%20Forms%20Booklet.v3.pdf) Please contact [ics4ics@isa.org](mailto:ics4ics@isa.org) if you would like help developing an exercise for your company or organization. ### Past ICS4ICS Exercises --- The ICS4ICS exercises provide an excellent way to understand ICS4ICS and the various resources, procedures, and processes. These exercises are scripted to help new participants play the various ICS4ICS roles. The exercise can also be delivered using prerecorded videos that are combined with a tabletop discussion with exercise participant to ensure they have the resources and organization capabilities to be able to perform during an actual cyber incident. The ICS4ICS Team uses the feedback from ICS4ICS exercises to improve the exercise, processes, and other materials. The participants provide feedback at the end of the exercise as part of a Hot-Wash. These are some of the past ICS4ICS exercises:   **Exercise** **Date** **Resources and Links** ##### 2025 **Battery Energy Storage ICS4ICS Exercise** June 3, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-191771951768.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLJkGuI92D%2FbzBuSxrHo%2FQGj1acomeyGFvX4VGpRPbobeXNp%2BbREkbSNyPQW4F4R%2BWd9DoL%2FGP4w7gcdiCuN%2FiVQs4Y5kofFljwTBrURcrnkOqtVADBVIpPkQYCkt2NawTPt%2BSOpMXVl1ZnaCavG3rZJfymNBDoPQbBXndSHZ6VGD%2BdfYp3HYD7kkmRryGWQJJ%2F9CliV5J4zv4TlBtGb5ww%3D&webInteractiveContentId=191771951768&portalId=21577316&hsLang=en) **ICS4ICS-Cyber Incident Response Metals-Mining Exercise** May 15, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-191774619150.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLKWCTxUFWC81auNFfouAKGhzWfOTiMX5yRYDH%2B1j7ZUGO9p7RkW2Nm6%2FVJNTkfcYpx3914hFnC7a8nJcwkEREYE%2F2iDOGzR7OLlOnpYBWQoIsTnrQ7s06H6q5gx%2FCHcQutF37T%2Bvu1yNQ55qqQukKtk6IyegQeq2GVTFiOMOBm%2F9e%2Fy4ctxzI%2Fnu5SIrI5Dvl0shIsYITwdrXTc0LGTaMs%3D&webInteractiveContentId=191774619150&portalId=21577316&hsLang=en) ICS4ICS-Cyber Incident Response Electrical (Power Generation) Exercise April 1, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-191771951713.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLJZVqQePbpuJVaCozyXlLczErmdF%2FsKOYiGkxj1hSW1CrM67bPSbWzgJwO4G23GWeh96l%2F4HWl4Uy0vnsrp2kNrPyFEla%2B0BQyk51%2FHf1xyL0d5XrFITUnTLxQl4tgXG%2BieYi1wqAWsBIlBp5pDzHO90ZaAldu7m8w8Dc1Jjda6RXwuRSWCpWq46OYmuR%2FS87l8tsY7j7FJxKAgAi4aWw%3D%3D&webInteractiveContentId=191771951713&portalId=21577316&hsLang=en) Cybersecurity Controls and ICS4ICS for Higher Education March 27, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-189459573415.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLL%2B%2BnvpwkCpCDgpaPhcFsKG94gbfhTNTjG5kNZgTn2RbPA7sv06SU3GuIXJFlWz214hFjwN2QbFObttPKlJD5AXds9JGStMG6F1fdm0jJGXQtmzp0WodPgCWVIlunXGizDNcIFpHZrcG%2BtwMAbzlvnyiBPV0tJwIPZD4aq411ufDy11LkKj46e6AxW5tXfMG71GnJXe%2FqtlqNDO7dYDGPQ%3D&webInteractiveContentId=189459573415&portalId=21577316&hsLang=en) [ View Resource ](https://www.ics4ics.org/hubfs/ICS4ICS%20Resources/ICS4ICS%20Security%20Controls%20Handout.pdf?hsLang=en) Staffing a Cyber Incident Response and ICS4ICS Organization  March 25, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-188389755245.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLLt2XLrAfhbHpwNo1ACWvuV41cgi2afSvHEivcFCWPvmYzsF3qH4pZjVEkV0%2BuaVM2vX1XrIYaOeGLjAaZKtWnYYmlw5W1qpdUucgYgVHjL25uyFz5CkwAPIk9%2Bift0PvVQrEIERHHECtV1TvWdo9gx5Y0zlAISkBgif4stPNT55jMBlhxx6bRA8tZgfQHAbVxN6B9Xs8gW8xafElxqY49m&webInteractiveContentId=188389755245&portalId=21577316&hsLang=en) [ View Resources ](https://www.ics4ics.org/staffingandworkforce?hsLang=en) Pipeline Cyber Incident Response Leveraging ICS4ICS March 20, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-188389755041.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLJA9CSqtJVyRQe8t0ImVEA1tOGqM%2FQtXjaf79mAoh8HKGirIt%2FbJ7KxUO3l0m2AoYRAXhvWpbMPHPuhiPrC9X25dAaCbT3C5KYmoN%2BqNoAKVd0Fl3WeAj7LXH12rT%2BOYnfd%2FrW%2BZTQ%2BuSfWAOa6rpxjtfEQSgiWFkwtD4red0e6%2FntuDr1rZvPo7cMEsNIewc%2BxpQKUfqkJpnHn1qYM3QVS&webInteractiveContentId=188389755041&portalId=21577316&hsLang=en) [ View Resource ](https://www.ics4ics.org/hubfs/20250204CS4ICS_Exercise_Pipeline%20-%20References.pptx?hsLang=en) ICS4ICS and Cyber Incident Response Exercise for Space March 18, 2025 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-188389754630.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLJ3vHWi1fSGhZCI8bg3sRRqO4wxFGhSbbl17oA40zOKMjwXIkbQAzESH3%2B450WPy%2FlZtgXZIkiR%2Bad2NoDuwgJ15nuNXn%2FAVONCwdoRZED9t%2BeZD%2Bhp2NCUF9JNmNk%2BKBIRt0kG0JFAlJoFqtYDMfsQf2PLhifLPeKPTw5%2F%2FhZxojck5ZAehxtARE17yO%2FkHIV%2Bjzd6EU9NH2638fLV%2BHym&webInteractiveContentId=188389754630&portalId=21577316&hsLang=en) [ View Resource ](https://www.ics4ics.org/hubfs/ICS4ICS%20Resources/ICS4ICS%20Space%20Inter-Agency%20Communications.pdf?hsLang=en) ##### 2024 Chemical ICS4ICS Cyber Incident Exercise Nov. 20, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-183435392633.png) ICS4ICS Rail Australia-New Zealand Exercise Nov. 13, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-183437589663.png) **Manufacturing ICS4ICS Cyber Incident Exercise** Oct. 30, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-183192148348.png) ICS4ICS Rail North American Exercise Oct. 29, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-183437589563.png) [ICS4ICS Workforce Development ](https://www.ics4ics.org/work-force-development?hsLang=en) Sept. 26, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-182511766033.png) **Shipping ICS4ICS Cyber Incident Response Exercise** Sept. 19, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-182509161795.png) **ICS4ICS - Cyber Incident Response Exercise with Dragos** Sept. 19, 2024 [![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-182509161902.png) ](https://www.ics4ics.org/hs/cta/wi/redirect?encryptedPayload=AVxigLKZZueHsTSMzmcr6BhTw%2Fbdi68DH791EA0msoMyxkQmmY6Y4OaRFJyPKdlfaoUGXGGvxlfhm%2BJ%2BWJsh%2B1JV3ze1Cdy9BXVChwX5dW2s5XAy7%2FrB6tAoFKtgnUmTBUzYsYkvA26cCJI82GxCay8vocSDVg8cwqrZir2l02DV6z9OF98XbzTxEQes0lhzS0F%2F6bDdtNps%2BhkaFh2xgMMgIw6a&webInteractiveContentId=182509161902&portalId=21577316&hsLang=en) [**ISA OT Cybersecurity Summit**](https://otcs.isa.org/) Sept. 19, 2024 ![Download Webinar Recording](https://no-cache.hubspot.com/cta/default/21577316/interactive-182509179545.png) ##### 2023 ##### [GridSecCon 2023 (nerc.com)](https://www.nerc.com/pa/CI/ESISAC/Pages/GridSecCon.aspx) Oct 17, 2023 - [GridSecCon 2023 - Quebec CA.pdf (nerc.com)](https://www.nerc.com/pa/CI/ESISAC/GirdSecCon/GridSecCon%202023%20-%20Quebec%20CA.pdf) - [ICS4ICS Exercise at GridSecCon Oct17-2023](https://www.ics4ics.org/hubfs/ICS4ICS_Exercise_Report_Oct17-2023.pdf?hsLang=en) ##### ISA Automation & Leadership Conference Oct 5, 2023 - [ISA Announces 2023 Automation and Leadership Conference in Colorado](https://www.isa.org/news-press-releases/2023/july/isa-announces-2023-automation-and-leadership-confe) - [ICS4ICS Exercise Report from ISA Automation & Leadership Conference](https://www.ics4ics.org/hubfs/ICS4ICS_Exercise_Report_Oct5-2023.pdf?hsLang=en) - [ISA Automation & Leadership Conference (future event)](https://www.isa.org/events-and-conferences/isa-automation-and-leadership-conference) ##### OT ISAC in Singapore Sept 7, 2023 - [OT-ISAC Summit 2024 | OT-ISAC (otisac.org) (future event)](https://www.otisac.org/otisacsummit2023) ##### Virtual exercise Jul 13, 2023 Jun 28, 2023 - Asia-Australia exercise – Virtual (coming soon) - [ICS4ICS Virtual Exercises Report](https://www.ics4ics.org/hubfs/ICS4ICS_Exercise_Report_from_virtual_exercises_June-July-2023.pdf?hsLang=en) ##### ISA - OT Cybersecurity Summit May 30, 2023 - [The ISA to host first Cybersecurity Summit in Scotland](https://www.isa.org/news-press-releases/2023/april/isa-to-host-energy-focused-cybersecurity-summit-in) - [ICS4ICS Exercise Report for ISA Cybersecurity Summit in Scotland](https://www.ics4ics.org/hubfs/ICS4ICS_Exercise_Report_ISA_Cybersecurity_Submit_May30-2023.pdf?hsLang=en) - [OT Cybersecurity Summit (future event)](http://www.isa.org/otcyber) ##### Cyber conference (Polish) May 24, 2023 - [CyberTek Tech Festival](https://cybertek.com.pl/en/home) ##### Chemical Co. May 2, 2023 - [First Asset Owner exercise provided significant feedback on program](https://www.ics4ics.org/hubfs/ICS4ICS_Exercise_Report_May2-2023.pdf?hsLang=en) ##### 2022 ##### OT ISAC in Singapore Sept 7, 2022 - [OT-ISAC Summit 2022 | LinkedIn](https://www.linkedin.com/posts/operational-technology-information-sharing-and-analysis-center-ot-isac_ot-isac-summit-2022-registration-is-now-open-activity-6937658817937571840-sCuc/) ##### ICS4ICS Exercise at S4 April 18, 2022 - ICS4ICS exercise at first large public event - [◦ Initial phase of an incident](https://www.youtube.com/watch?v=l4ec0SjfcH8) - [◦ Evolution of an incident](https://www.youtube.com/watch?v=E-x_E8qrNZs) ### ICS4ICS Exercise Team The ICS4ICS exercise team creates most of the ICS4ICS exercise materials and many of the ICS4ICS resources. The team meets monthly. [Join the Exercise Team ](https://www.ics4ics.org/ics4ics-request-form?hsLang=en) ### Monthly Newsletter Want to be added to the ICS4ICS monthly newsletter or join some of the ICS4ICS teams? [Sign Up ](https://www.ics4ics.org/ics4ics-request-form?hsLang=en)