Lesley Carhart of Dragos has been involved in numerous cyber incident responses in both OT and IT. They begin by highlighting the differences in Incident Response in OT (and in more detail at 21:05) and the value of tabletop exercises.

Lesley then digs into how to create and run a great OT tabletop exercises. Prerequisites, timelines, injects, roles and more. The tips at 19:20 are a highlight as are the what will go wrong shortly after this.