ICS Program & Policy Development GICSP Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An ICS security program has been operating for three years. The risk assessment is updated annually, but the program's policies have not been reviewed since their initial approval. A new regulation now requires stricter access controls for remote vendors. The security manager must update the program efficiently. What is the best approach?

   • ARewrite all ICS policies from scratch to ensure consistency with the new regulation
   • BDelay any policy changes until the next annual risk assessment is completed
   • CApprove the new regulation as a standalone policy without integrating it into existing policies
   • DConduct a focused review of the remote access policy, update it to meet the new regulation, and schedule a full program review within the next year
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A manufacturing company is developing its first ICS security policy. The policy will govern remote access to the OT network. The security manager has drafted the policy and now needs to move it through the approval process. Which step should occur before the policy is formally approved and published?

   • APurchase and deploy a new VPN concentrator to support the policy's technical requirements
   • BDelete the draft and start over because policies cannot be revised after initial drafting
   • CConduct a review with OT engineers, plant management, legal, and HR to ensure the policy is practical and enforceable
   • DImmediately distribute the policy to all employees via email to ensure rapid compliance
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A manufacturing plant is integrating risk management into its ICS security program. The plant has a legacy PLC that cannot be patched, and it is critical to production. The risk assessment shows a high likelihood of exploitation. Which risk treatment option is most appropriate for this scenario?

   • ATransfer the risk to the PLC vendor by requiring them to provide a patch
   • BImplement compensating controls, such as network segmentation and monitoring, to reduce the risk of exploitation
   • CReplace the PLC immediately with a modern controller, regardless of production impact
   • DAccept the risk without any controls because the PLC is critical and cannot be taken offline
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A food processing company is developing an ICS security program. A risk assessment identified that a compromise of the PLC controlling the pasteurization process could cause product contamination and regulatory fines. The company has limited budget. Which action best integrates risk management into the program?

   • ATransfer the risk entirely by purchasing cyber insurance and taking no further action.
   • BApply the same security controls to all ICS assets regardless of risk to ensure uniform protection.
   • CDefer all security investments until a regulatory audit requires them.
   • DPrioritize controls for the pasteurization PLC and its network path, such as network segmentation and strict change management, before addressing lower-risk systems.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a key requirement for an effective ICS security training program?

   • AFocusing exclusively on technical staff and excluding operators
   • BOffering training only once during employee onboarding
   • CProviding the same generic training to all employees regardless of role
   • DTailoring training content to the specific roles and responsibilities of each employee group
   Reveal Solution Discussion Select an answer first