If engineering and operations are left out of cybersecurity training and exercises, it’s no surprise that they’d also tend to be overlooked during the pressure of an actual incident. The complexity in manufacturing and industrial control systems is not understood by network security. Simply restarting IT and OT networks from a “golden backup” is not sufficient to safely restart a manufacturing or industrial facility. There is a need for both an “engineering” role and participation from engineering and Operations representatives in tabletop exercises that address plant operations.