ICS Program & Policy Development GICSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of a continuous improvement activity for an ICS security program?

   • AUpdating policies and procedures based on lessons learned from a security incident
   • BConducting a single annual risk assessment and never repeating it
   • CKeeping policies unchanged to ensure stability
   • DDeleting incident reports after they are reviewed
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which regulatory framework is mandatory for the cybersecurity of bulk electric systems in North America?

   • AHIPAA
   • BISA/IEC 62443
   • CGDPR
   • DNERC CIP
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of conducting periodic reviews of the ICS security program?

   • ATo compare the program against competitors' security programs
   • BTo identify changes in the threat landscape, operational environment, or business requirements that may necessitate updates to the program
   • CTo justify the annual security budget without making any changes
   • DTo ensure that all employees are aware of the program's existence
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational manufacturing company operates facilities in the EU and the US. The EU facility must comply with GDPR regarding personal data, and the US facility is subject to state cybersecurity regulations. The company is developing a global ICS security program. What is the most appropriate approach to regulatory alignment?

   • ADevelop a global baseline program based on ISA/IEC 62443, then add region-specific controls to meet GDPR and state regulations
   • BIgnore regional regulations and rely solely on the company's internal security standards
   • CCreate separate, entirely independent security programs for each facility with no shared baseline
   • DAdopt the strictest regulation (GDPR) for all facilities worldwide to simplify compliance
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A food and beverage company is integrating risk management into its ICS security program. A risk assessment identified that a cyber attack on the bottling line could cause a product recall, but the likelihood is moderate. The company has a limited budget and must choose between two controls: network segmentation (cost: $50,000) and enhanced logging and monitoring (cost: $20,000). The bottling line is currently flat on the network. Which decision best applies risk management principles?

   • AImplement both controls because they are complementary, even if it exceeds the budget.
   • BImplement enhanced logging and monitoring because it is cheaper and provides visibility into attacks.
   • CAccept the risk because the product recall would be covered by insurance.
   • DImplement network segmentation because it reduces the likelihood of a successful attack by limiting lateral movement, which is a higher priority given the moderate likelihood.
   Reveal Solution Discussion Select an answer first