Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An international manufacturing company is implementing ISO/IEC 27001 and ISA/IEC 62443 across its global facilities. The company must comply with different data protection regulations in each country. The security team is developing a unified ICS security policy. What is the BEST approach to handle regulatory differences?

   • ADevelop a global baseline policy and add regional addenda to address specific local regulatory requirements.
   • BFocus only on the requirements of the country where the corporate headquarters is located.
   • CCreate a separate, fully independent security policy for each country to ensure complete compliance.
   • DAdopt the most stringent regulatory requirements from any single country and apply them globally.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company wants to establish an ICS security policy based on ISO standards. They have limited resources and need a structured approach. Which first step should they take?

   • AConduct a gap analysis comparing current practices against ISO/IEC 27001 and ISA/IEC 62443 requirements.
   • BHire an external auditor to certify the company against ISO/IEC 27001 immediately.
   • CImmediately implement all controls from ISO/IEC 27002 to ensure full compliance.
   • DPurchase and deploy a new SIEM solution to monitor the ICS network.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is preparing for an ISO 27001 surveillance audit after implementing an ISMS that includes ICS. The auditor has requested evidence of continuous improvement. Which evidence would best demonstrate this?

   • AA vendor's brochure for a new firewall that was purchased.
   • BA list of all security incidents from the past year.
   • CThe original risk assessment document from the initial implementation.
   • DMinutes from quarterly management reviews that include security metrics and action items.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A city's water utility is implementing ISO/IEC 27001 and has a limited budget. The utility has identified several critical gaps, including lack of network segmentation, no formal incident response plan, and inadequate access controls. The security manager must prioritize the roadmap. Which factor should be the PRIMARY consideration when prioritizing these gaps?

   • AThe cost of implementing each control relative to the available budget.
   • BThe likelihood of a cyber attack targeting the water utility.
   • CThe potential impact on public health and safety if the water supply is disrupted.
   • DThe ease of implementation and the availability of staff to complete the work.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A mid-sized manufacturing company has just drafted its first ICS security policy based on ISO/IEC 27001. The policy has been reviewed by the IT security team. What is the NEXT step in the governance process?

   • ASubmit the policy to executive management for formal approval and authorization.
   • BImmediately distribute the policy to all employees and begin enforcement.
   • CDevelop detailed procedures for each control mentioned in the policy.
   • DConduct a full risk assessment to identify any gaps in the policy.
   Reveal Solution Discussion Select an answer first