6. Why does industrial incident response need a different authority model?

Suggested expert: Robert M. Lee. Why it matters: cyber containment can interrupt a physical process.

Context: Lee's House testimony establishes relevant OT expertise; the proposed answer is not drawn from a private conversation.

Good-answer framing — editorial: describe how safety, engineering and operations participate in a response decision. Explain why the asset's function matters, how passive visibility and approved testing fit, and how to prepare for a responder unfamiliar with the plant. Address ownership of restoration and return-to-service approval.

Follow-up: “What action that is routine on an office laptop should never be assumed safe on a production asset?”