Establishing Policy - ISO Roadmap ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is an important audit consideration when auditing an ICS/SCADA environment against ISO 27001?

   • AAudits should be conducted without any prior planning.
   • BAuditors must understand the operational and safety constraints of ICS/SCADA systems.
   • CAuditors should only review documentation, not interview personnel.
   • DAudits must be performed during peak production times to test real-world conditions.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An automation engineer is reviewing security standards for a new chemical plant. They need a standard that specifically addresses the unique requirements of industrial automation and control systems. Which standard should they reference?

   • AISO/IEC 27002
   • BISO/IEC 27001
   • CISA/IEC 62443
   • DNIST SP 800-82
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large petrochemical company is implementing ISO/IEC 27001 and using ISA/IEC 62443 as a technical reference. The company has a mature IT security program but is new to OT security. The OT environment includes legacy systems that cannot be patched and modern systems that are fully supported. The security team must develop a policy that addresses both. The company also faces regulatory pressure to demonstrate due diligence. What is the MOST effective approach?

   • ARequire all legacy systems to be replaced within the next fiscal year to eliminate the patching issue.
   • BAdopt a risk-based approach that applies compensating controls for legacy systems and standard controls for modern systems.
   • CFocus exclusively on achieving ISO 27001 certification and defer IEC 62443 implementation until after certification.
   • DApply the same security controls to all systems regardless of age or support status to ensure consistency.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the first step in developing a roadmap for establishing an ICS security policy based on ISO standards?

   • ADeveloping a risk treatment plan
   • BObtaining ISO certification
   • CImplementing security controls
   • DConducting a gap analysis
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A nuclear power plant is establishing an ICS security policy based on ISO/IEC 27001. The plant is subject to strict regulatory oversight, and the policy must be approved by multiple stakeholders, including operations, safety, and IT. The stakeholders have conflicting priorities: operations wants minimal disruption, safety wants strict controls, and IT wants standard IT practices. What is the BEST governance approach to reconcile these interests?

   • AAppoint an external consultant to write the policy without consulting internal stakeholders.
   • BEstablish a cross-functional steering committee with representatives from operations, safety, and IT to review and approve the policy.
   • CAllow operations to have the final say since they are responsible for the plant's primary mission.
   • DLet the IT department finalize the policy since they have the most security expertise.
   Reveal Solution Discussion Select an answer first