<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ics-backup-recovery
description: >-
  Design and maintain backup and disaster recovery procedures for ICS/SCADA
  components including PLC programs, HMI configurations, historian databases,
  and network device configs with air-gapped storage and tested restoration.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - backup
  - recovery
  - ics
  - scada
  - disaster-recovery
  - plc
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0809", "T0831"]
  nist-csf: ["PR.IP-4", "RC.RP-1"]
  iec-62443: ["SR 7.3", "SR 7.4"]
  uuid: a1b2c3d4-1001-4000-a001-000000000006
---

# Implementing ICS Backup & Recovery

## Overview

ICS backup and recovery is critical for resilience against ransomware, insider
sabotage, and accidental misconfiguration. Unlike IT systems, ICS recovery must
restore exact PLC logic, HMI screens, and process configurations to prevent
production disruption or safety incidents. Backups must be air-gapped and tested.

Mode: `[MODE: BLUE]` for backup operations; `[MODE: ARCHITECT]` for recovery design.

## Prerequisites

| Requirement | Details |
|---|---|
| Complete ICS asset inventory with device types and programming software | Required |
| PLC vendor tools | TIA Portal (Siemens), RSLogix (Rockwell), Unity Pro (Schneider) |
| Secure air-gapped storage for backup media | Required |
| Backup verification environment matching production hardware | Required |
| Documented RTO and RPO objectives | Required |
| Change management integration for backup triggers | Required |

## Key Concepts

### PLC Program Backup

```bash
python3 -c "
import snap7, hashlib, json, datetime
plc = snap7.client.Client()
plc.connect('10.10.0.50', 0, 1)
blocks = {}
for bt, te in [('OB', snap7.types.BlockType.OB), ('DB', snap7.types.BlockType.DB)]:
    for num in plc.list_blocks_of_type(te):
        data = plc.upload(te, num)
        open(f'plc_{bt}{num}.bin','wb').write(data)
        blocks[f'{bt}{num}'] = hashlib.sha256(data).hexdigest()
plc.disconnect()
json.dump({'ts': str(datetime.datetime.now()), 'blocks': blocks}, open('manifest.json','w'), indent=2)"
```

### Network Device Backup

```bash
for device in $(cat ot_network_devices.txt); do
  ssh admin@$device 'show running-config' > "configs/${device}_$(date +%Y%m%d).cfg"
done
sha256sum configs/*.cfg > configs/checksums.sha256
```

### Air-Gapped Storage

```bash
mkdir -p /mnt/airgap/backups/$(date +%Y%m%d)
cp -r manifest.json plc_*.bin configs/ /mnt/airgap/backups/$(date +%Y%m%d)/
sha256sum /mnt/airgap/backups/$(date +%Y%m%d)/* > /mnt/airgap/backups/$(date +%Y%m%d)/verify.sha256
cd /mnt/airgap/backups/$(date +%Y%m%d) && sha256sum -c verify.sha256
umount /mnt/airgap
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 implementing_ics_backup_recovery_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 implementing_ics_backup_recovery_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 implementing_ics_backup_recovery_report.py --results results/ --output report.json
```

## Verification

- [ ] All PLCs, HMIs, historians in scope
- [ ] Automated schedule (daily configs, weekly programs)
- [ ] SHA-256 checksums verified
- [ ] Air-gapped copy maintained
- [ ] Restoration tested quarterly
- [ ] RTO/RPO documented
- [ ] Change management triggers backups
- [ ] Failure alerts configured

## Detection Opportunities

- Schedule failures → risk or tampering
- Checksum mismatches → unauthorized changes
- Unauthorized storage access → exfiltration
- Missing backups → coverage gap
- Restoration failures → corruption

```yaml
title: Ics Backup Recovery Detection
id: 05d82b49-e9d0-4442-bb3d-96b52a383556
status: experimental
description: Detects suspicious activity related to implementing ics backup recovery techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0809
  - attack.t0831
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- NIST SP 800-82 Rev 3 — Section 6.2.7
- IEC 62443-2-1: IACS Security Management
- CISA Ransomware Guide — OT
- ISA-TR84.00.09
