ICS Program & Policy Development GICSP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A mid-sized electric utility that is not a bulk electric system (BES) operator wants to improve its ICS security posture. It is subject to state public utility commission regulations and is considering adopting a recognized standard to guide its program. Which approach best aligns the utility's program with regulatory expectations?

   • AWait for a federal mandate before implementing any ICS security controls
   • BAdopt NERC CIP requirements in full, even though the utility is not a BES operator
   • CUse ISA/IEC 62443 as a framework and map its controls to state regulations and the utility's risk assessment
   • DIgnore external standards and rely solely on the utility's existing IT security policies
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A hospital is defining the scope of its ICS security program. The hospital has a building management system (BMS) that controls HVAC and elevators, and a separate clinical engineering network for medical devices. The board asks which systems should be included in the ICS security program. What is the best scoping decision?

   • AExclude both from the ICS program and treat them as part of the IT network
   • BInclude both the BMS and the clinical engineering network because both are operational technology that affects patient safety and facility operations
   • CInclude only the BMS because it is a traditional ICS, and exclude medical devices because they are regulated by FDA
   • DInclude only the clinical engineering network because it directly affects patient care
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An electric cooperative has had an ICS security program for three years. During a recent audit, several controls were found to be ineffective, and the threat landscape has changed significantly. What is the most appropriate action to support continuous improvement?

   • AWait for the next regulatory inspection before making any changes.
   • BReplace the entire program with a new framework to start fresh.
   • CConduct an annual review of the program, update the risk assessment, and revise policies and controls based on the audit findings.
   • DKeep the program unchanged because it was approved by management three years ago.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A chemical plant is subject to both NERC CIP and ISA/IEC 62443 because it has a large co-generation facility that feeds the bulk power system. The security team is developing a single ICS security program. Which approach best aligns the program with both sets of requirements?

   • AUse ISA/IEC 62443 as the sole basis because it is more comprehensive than NERC CIP.
   • BCreate two entirely separate programs, one for NERC CIP and one for ISA/IEC 62443, to avoid confusion.
   • CDevelop a single program that uses ISA/IEC 62443 as the foundational framework and maps each control to the applicable NERC CIP requirements.
   • DFocus the program only on the co-generation assets because they are NERC CIP regulated.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A utility has implemented a policy that requires all OT personnel to use a new vendor management system for remote access requests. The policy has been in place for six months, but compliance is low because operators find the system cumbersome. The security manager must improve compliance. What is the most effective approach?

   • AIncrease penalties for non-compliance to deter operators from bypassing the system
   • BRevoke remote access privileges for all operators until they comply
   • CSimplify the vendor management system workflow and provide additional training to operators
   • DAssign a dedicated administrator to submit all remote access requests on behalf of operators
   Reveal Solution Discussion Select an answer first