Rogue Device Response

Incident Investigation & Isolation Protocol

Doc ID: TAG-OT-CHK-02
Issue Date: Feb 2026
Rev: 1.0

Compare MAC/IP against Master Asset Inventory.
Check Port Status on managed switch (ECR/Bridge).
Verify with Crew: Is an OEM Service Engineer onboard?

⚠️ DO NOT disconnect critical IACS hardware. Follow these steps for unknown devices only:

Physical Isolation: Trace cable to switch and physically remove the connection.
Logical Isolation: Use CLI/Web GUI to shutdown the specific port.
Quarantine: If the device is a laptop, ensure it is removed from the Engine Room/Bridge space immediately.

Incident Description:

Root Cause:

Unauthorized Vendor Access Crew Error Potential Cyber Attack
Other:

Investigated By (ETO):

Signature & Date

Verified By (Master):

Stamp & Date

Get the full editable TAG-OT-CHK-02 and our IACS-compliant IAM playbook.