ICS Program & Policy Development GICSP Practice Questions (Page 11)

Questions 51–51

1. 51application · medium

   A mining company is integrating risk management into its ICS security program. The risk assessment shows that a cyber attack on the conveyor control system could cause a fatal accident, but the likelihood is low because the system is air-gapped. The company has a limited security budget. What is the most appropriate risk-based decision?

   • AImplement physical security controls and strict access controls around the air-gapped system to reduce the likelihood further.
   • BAccept the risk because the system is air-gapped and the likelihood is low.
   • CIgnore the risk because the system is not connected to the internet.
   • DSpend the entire security budget on network monitoring for the air-gapped system.
   Reveal Solution Discussion Select an answer first