A mid-sized electric utility is subject to NERC CIP for its bulk electric system (BES) cyber assets, but it also has a distribution SCADA system that is not BES. The utility wants to develop a single ICS security program that satisfies both NERC CIP and ISA/IEC 62443. The security team is small and has limited budget. Which approach is most effective?

Develop two separate programs, one for NERC CIP and one for ISA/IEC 62443, to ensure full compliance.

Focus the program exclusively on NERC CIP compliance for BES assets and ignore the distribution SCADA.

Build the program around ISA/IEC 62443, and map the controls to NERC CIP requirements for the BES assets, using a risk-based approach to prioritize the distribution SCADA.

Use only NERC CIP as the basis for the program because it is mandatory.

What is the first step in developing an ICS security policy?

Implement technical controls to enforce the policy

Conduct a risk assessment to identify threats and vulnerabilities

Draft the policy document and circulate it for review

Obtain approval from the board of directors

Which of the following is a typical step in the review and approval process for an ICS security policy?

Soliciting feedback from stakeholders such as operations, engineering, and safety

Publishing the policy on the company intranet without prior review

Deleting all previous versions of the policy to avoid confusion

Automatically enforcing the policy through technical controls without human approval

A pipeline company is updating its ICS security policy to require annual penetration testing of the OT environment. The OT operations manager is concerned that active testing could disrupt the pipeline. Which stakeholder role is most appropriate to approve the final testing window and scope?

The OT operations manager, because they understand process safety and can identify safe testing windows.

The IT security team, because they are responsible for conducting the penetration test.

The corporate legal department, because they need to manage liability.

The external penetration testing vendor, because they know the technical details of the test.

What is the purpose of conducting periodic audits of ICS security policy compliance?

To assign blame to employees who have violated policies

To ensure that all employees have read the policy

To replace the need for technical controls

To identify gaps between policy requirements and actual practices so corrective actions can be taken

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 2

ICS Program & Policy Development GICSP Practice Questions (Page 2)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 6–10

6expert · hard
A mid-sized electric utility is subject to NERC CIP for its bulk electric system (BES) cyber assets, but it also has a distribution SCADA system that is not BES. The utility wants to develop a single ICS security program that satisfies both NERC CIP and ISA/IEC 62443. The security team is small and has limited budget. Which approach is most effective?
Select an answer first
7foundation · easy
What is the first step in developing an ICS security policy?
Select an answer first
8foundation · easy
Which of the following is a typical step in the review and approval process for an ICS security policy?
Select an answer first
9application · medium
A pipeline company is updating its ICS security policy to require annual penetration testing of the OT environment. The OT operations manager is concerned that active testing could disrupt the pipeline. Which stakeholder role is most appropriate to approve the final testing window and scope?
Select an answer first
10foundation · easy
What is the purpose of conducting periodic audits of ICS security policy compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.