AHS Cyber Incident Response Playbook (PDF)

The AHS Cyber Incident Response Playbook addresses the unique threat landscape faced by autonomous mining haul trucks, which integrate real-time embedded systems, GPS/RTK navigation, wireless telemetry (e.g., LTE/5G, Wi-Fi 6, private radio), and centralized dispatch platforms. Unlike generic IT incident response playbooks, it accounts for safety-critical constraints—such as the inability to 'reboot' a 400-ton moving vehicle mid-shift—and prioritizes fail-safe operational continuity alongside forensic integrity. The playbook is structured around the NIST SP 800-61r2 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), but adapts each phase to AHS-specific assets: e.g., Preparation includes secure boot validation for onboard ECUs and air-gapped firmware update protocols; Detection leverages behavioral anomaly detection on CAN bus traffic and telematics metadata rather than traditional endpoint logs. It further defines cross-functional coordination between OT engineers, mine control room operators, cybersecurity analysts, and OEM support teams—emphasizing time-bound escalation paths, pre-approved communication templates, and offline response checklists for low-connectivity pit environments. Crucially, the playbook integrates regulatory alignment with standards such as IEC 62443-3-3 (security risk assessment), ISO/SAE 21434 (road vehicle cybersecurity engineering), and MINExpo Cybersecurity Guidelines, ensuring compliance across jurisdictional and contractual boundaries.