The breach is patched. The batch isn't.

Here is an uncomfortable observation from twenty years of plants: the moment a security team declares "systems restored", there is almost always a rack of parts in the building that was made on stale or compromised data, wearing paperwork that swears everything was normal. SANS's latest OT survey puts incidents at a third of industrial organisations, and the commentary since has demanded that OT security grow up. Fine. Not one CISO dashboard I have ever seen answers the only question a customer will ever ask: what did we ship while we were exposed? Downtime gets measured in hours and restored bytes. The customer measures in parts.

The exposure window – the clock nobody starts

Ask a CISO when the incident began and you get the detection time, because that is what the tools log. Ask a quality director and you get a different clock. The exposure window opens at first compromise – usually unknown – and closes only when validated process control is restored and verified against a known-good baseline. Everything made inside that window is suspect stock. Not defective. Suspect. Different word, different discipline, and the discipline belongs to quality.

I once watched a heat-treatment line whose data historian went flat for six hours while incident response worked a ransomware event one segment over. The oven ran on. The parts moved. The certificates printed. Nobody started a quality clock, because on the org chart a dead historian was an IT problem – until it landed on a customer's receiving dock as the customer's problem. A compromised PLC is not a data risk. It is a process-control risk with a production record attached, and that record was being written the whole time.

The records you already keep are the forensic evidence

The good news: an audit-ready plant is already forensically ready. SPC charts, torque curves, vision images, PLC setpoint logs, batch genealogies, poka-yoke activations – IATF 16949 and AS9100 have forced part-level traceability on us for two decades. A post-breach investigation is not some exotic discipline. It is a join operation: incident timeline on one axis, production record on the other, and every lot that intersects the window gets a disposition.

When I built a QA/QC department from zero for a 900-plus employee greenfield plant, the containment path and the traceability architecture went onto the same whiteboard, deliberately. QRQC discipline kept our containments to hours: suspect fence up, genealogy pulled, physical quarantine, parts sorted before the next truck loaded. The same relentless muscle took 70% out of defect costs on that watch – containment speed pays. It bounds a cyber containment just as well, because suspect stock does not care whether the root cause was a bad bearing or a bad packet.

A firewall decides what gets into a plant. The quality records decide what gets out of it.

Nobody owns the bridge between bytes and parts

I am the awkward proof that the bridge can be held. Two decades as a quality director in automotive and aerospace. Certified Ethical Hacker, named on T-Mobile's bug-bounty Hall of Fame for a clickjacking disclosure. I can read the incident report and the control charts on the same day, because they describe the same event. Most plants have no such overlap, so the bridge stands empty. IT speaks in indicators, restore points and IOCs. Quality speaks in lots, dispositions and PPAP. Neither side can declare suspect stock alone, so nobody does, and the window quietly ships.

What the bridge needs is quality in the room, with containment triggers agreed before the incident rather than negotiated during it. They are not hard to write:

• PLC or HMI compromise: every part back to the last verified-good setpoint backup.
• Historian down or tampered: every lot certified on stale or interpolated data.
• Vision or SCADA integrity in doubt: re-inspection before release.
• Traceability broken: containment holds until the genealogy is rebuilt.

Boeing has spent years rebuilding trust in the 737 one demonstrated control at a time, and is still paying for the gap between parts, paperwork and reality. Bounding a window in hours is cheaper by orders of magnitude. In the roughest quarter I ever ran, we closed with zero critical customer escalations – not because nothing went wrong, but because nothing stayed quiet. Customers forgive the incident. They never forgive silence about the window.

So run one tabletop with that ending. When the IT lead reports the systems are back, keep the exercise going until someone slides a sheet across the table: the shipped-part list for the exposure window, traced from records the plant already keeps, every lot dispositioned. That artefact – not the patch report – is what a board should demand after an OT incident, because it is the only one that answers to the customer. The breach is patched by Friday. The batch answers for much longer.