A refinery has an ICS security policy that requires all OT network changes to be approved through a change advisory board (CAB). Recently, a critical safety system needed an emergency patch, but the CAB could not convene for 48 hours. The patch was applied without approval to prevent a potential safety incident. The security manager wants to prevent this situation from recurring. Which action best addresses the conflict between security policy and operational safety?

Remove the CAB approval requirement for all changes to avoid delays.

Revise the policy to include an emergency change process that allows expedited approval, with after-the-fact review and documentation.

Require all future patches to wait for the next CAB meeting, regardless of urgency.

Discipline the engineers who applied the patch without approval.

A natural gas distribution company is updating its ICS security policies to align with a new state regulation that requires annual third-party assessments. The current policy development process is informal and does not include a formal review cycle. Which improvement to the policy development process is most important?

Rely on the third-party assessor to update the policies during the annual assessment.

Establish a documented policy review and approval cycle that includes stakeholders and aligns with the annual assessment requirement.

Keep the informal process because it has worked in the past.

Adopt the state regulation verbatim as the company's policy.

How does risk management integrate into the development of an ICS security program?

By focusing solely on compliance with regulatory requirements

By using risk assessment results to prioritize security investments and define program scope

By eliminating all identified risks through the implementation of technical controls

By transferring all risks to an insurance provider

A hospital is developing an ICS security program that covers building automation systems (BAS) and medical gas monitoring. The facilities director wants the program to include only the BAS because it is networked, while the clinical engineering director wants to include the medical gas monitoring system because it is safety-critical. Which scope is most appropriate?

Include only the BAS because it is the only system connected to the corporate network.

Exclude both systems from the ICS program and address them under the general IT security policy.

Include both the BAS and the medical gas monitoring system, prioritizing based on risk to patient safety and operational continuity.

Include only the medical gas monitoring system because it is safety-critical.

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 2

ICS Program & Policy Development GICSP Practice Questions (Page 7)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 31–35

31expert · hard
A refinery has an ICS security policy that requires all OT network changes to be approved through a change advisory board (CAB). Recently, a critical safety system needed an emergency patch, but the CAB could not convene for 48 hours. The patch was applied without approval to prevent a potential safety incident. The security manager wants to prevent this situation from recurring. Which action best addresses the conflict between security policy and operational safety?
Select an answer first
32application · medium
A natural gas distribution company is updating its ICS security policies to align with a new state regulation that requires annual third-party assessments. The current policy development process is informal and does not include a formal review cycle. Which improvement to the policy development process is most important?
Select an answer first
33foundation · easy
How does risk management integrate into the development of an ICS security program?
Select an answer first
34application · medium
A hospital is developing an ICS security program that covers building automation systems (BAS) and medical gas monitoring. The facilities director wants the program to include only the BAS because it is networked, while the clinical engineering director wants to include the medical gas monitoring system because it is safety-critical. Which scope is most appropriate?
Select an answer first
35foundation · easy
Which of the following standards is specifically designed for the security of industrial automation and control systems (IACS)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

ICS Program & Policy Development GICSP Practice Questions (Page 7)

Questions 31–35

How does risk management integrate into the development of an ICS security program?

Which of the following standards is specifically designed for the security of industrial automation and control systems (IACS)?

Keep studying — Security Management and Response