ICS Program & Policy Development GICSP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A power utility has a security awareness training program that is identical to the corporate IT training. OT staff are required to complete it annually, but they report that it is not relevant to their work. As a result, they do not retain the information, and several recent incidents involved OT staff falling for phishing emails. Which approach best improves the training program?

   • AIncrease the frequency of the existing training from annual to quarterly.
   • BMake the training mandatory and track completion with disciplinary consequences.
   • CReplace the training with a one-time security awareness video.
   • DDevelop role-specific training for OT staff that includes ICS-specific scenarios, such as phishing targeting engineering workstations and the impact on process control.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A large electric utility that operates a bulk electric system (BES) is updating its ICS security program. The compliance team wants to ensure the program meets mandatory reliability standards. Which set of requirements must the program incorporate?

   • ANERC CIP standards, which are mandatory for BES entities and address cybersecurity of critical cyber assets
   • BISO 27001, which is the international standard for information security management systems
   • CPayment Card Industry Data Security Standard (PCI DSS), because the utility processes customer payments
   • DNIST SP 800-82, which provides guidance for securing industrial control systems
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A chemical plant is developing its ICS security program. The plant's risk assessment identified that a cyber incident could cause a toxic release. The safety department wants to ensure that security controls do not interfere with emergency shutdown systems. How should the security program integrate risk management to address this concern?

   • ADefer all security decisions until after the next scheduled plant shutdown
   • BApply the same security controls used for business IT systems to the emergency shutdown system
   • CPrioritize security controls that protect the emergency shutdown system while ensuring they are fail-safe and tested with safety engineers
   • DExclude the emergency shutdown system from the ICS security program to avoid interference
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A utility has adopted a new ICS security policy that requires all operators to use multi-factor authentication (MFA) when accessing the HMI. The training department is designing an awareness program. What is the most important element to include in the training to support this policy?

   • AA quiz on the penalties for non-compliance with the MFA policy
   • BAn explanation of the company's IT security policy for email and internet use
   • CHands-on practice with the MFA hardware tokens and how to respond if a token is lost or malfunctioning
   • DA detailed history of cyber attacks on other utilities
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A regional water utility is establishing an ICS security program. The utility is not a bulk electric system operator but must comply with state drinking-water regulations and is considering ISA/IEC 62443 as a framework. The board has asked for a document that defines the program's boundaries, the systems in scope, and the key stakeholders. Which document should the security manager produce first?

   • AA procurement specification for new PLCs to replace legacy controllers
   • BA detailed incident response runbook for the SCADA system
   • CAn ICS security program charter that states the program's purpose, scope, and governance structure
   • DA list of all ICS vulnerabilities identified in a recent penetration test
   Reveal Solution Discussion Select an answer first