A suspected cyber incident can force drinking water operators to make safety and continuity decisions before anyone knows whether SCADA or another operational system has been compromised. Using a realistic drinking water scenario and lessons from water-sector incidents and exercises, this session examines how operators can independently verify critical process conditions, define safe operating limits, decide when to use local or manual control, and escalate the incident. Attendees will practice separating confirmed operational effects from technical indicators and unverified reports. They will leave with a repeatable method for documenting what is known, what remains unknown, and what must be checked next.