OT Cybersecurity Best Practices for Small & Medium Organizations: How to Respond to a Ransomware Attack

**Executive summary:** This Dragos OT-CERT guidance outlines preparatory and response measures for ransomware affecting operational technology (OT)/industrial control systems (ICS), emphasizing offline backups of critical configuration files, periodic testing of restores, documented emergency operating procedures, tabletop exercises that simulate HMI/OT impacts, and advance coordination with legal, finance, and law enforcement to address legal, regulatory, and payment considerations.