Which term refers to legally enforceable rules created by government bodies or authorized organizations?
Correct Answer: B
ISA/IEC 62443 distinguishes between voluntary standards and legally binding obligations. Understanding this distinction is essential for compliance planning. Step 1: Definition of regulations Regulations are rules issued by governments or authorized regulators that carry legal force. Non-compliance can result in penalties, fines, or legal action. Step 2: Standards vs regulations ISA/IEC 62443 itself is a voluntary international standard unless incorporated into law or contracts. Frameworks and special publications provide guidance but lack inherent legal enforceability. Step 3: ISA/IEC 62443 context The standard acknowledges that asset owners must comply with applicable regulations first, then apply standards like 62443 to meet cybersecurity objectives. Step 4: Correct terminology Only regulations meet the definition of legally enforceable rules. Therefore, the correct answer is Regulations.
Question 87
What is a key activity in the Maintain phase?
Correct Answer: B
The "Maintain" phase is the fourth phase of the IACS Cybersecurity Lifecycle described in ISA/IEC 62443-2- 1. A key activity in this phase is managing changes (also known as "change management"). This activity ensures that any modifications to the IACS environment (hardware, software, processes, etc.) are evaluated for cybersecurity impact, and proper controls are implemented to maintain the intended security posture. While risk assessment is typically done in the Assess phase, and allocating assets and designing countermeasures belong to earlier phases, managing changes is essential for ensuring ongoing compliance and effectiveness of cybersecurity controls over time. Reference: ISA/IEC 62443-2-1:2009, Section 5.6 (Maintain Phase), Table 3 (CSMS lifecycle activities).
Question 88
Which of the following is NOT listed under Organizational Security Measures (SP Element 1)?
Correct Answer: A
ISA/IEC 62443-2-1 defines SP Element 1 - Organizational Security Measures as the set of governance, policy, and people-focused controls that establish the foundation of an IACS Security Program. These measures are organizational in nature and are intended to create accountability, awareness, and structured risk management. Step 1: Scope of SP Element 1 SP Element 1 includes activities such as: * Security policy definition * Roles and responsibilities * Personnel security (e.g., background checks) * Security awareness and training * Supply chain security governance These controls ensure that people, processes, and third-party relationships support cybersecurity objectives. Step 2: Why malware protection does not belong here Malware protection is a technical control, not an organizational measure. In ISA/IEC 62443, malware protection is addressed under SP Element 4 - Component Hardening, which focuses on endpoint protection, anti-malware mechanisms, and secure configurations. Step 3: Why the other options are valid * Background checks are explicitly part of personnel security. * Supply chain security is a key organizational concern. * Security awareness training ensures staff understand their responsibilities. Therefore, Malware protection is not listed under SP Element 1.
Question 89
An industrial control system requires strong protection against intentional violations using sophisticated means and moderate skills. According to the Security Level (SL) definitions, which SL should be targeted?
Correct Answer: C
ISA/IEC 62443 defines Security Levels (SL 0-4) as qualitative representations of the system's ability to withstand different attacker capabilities. These definitions are consistent across system (3-3) and component (4-2) requirements. Step 1: Understanding attacker models * SL 1 addresses casual or accidental misuse. * SL 2 addresses intentional violations using simple means and low skill. * SL 3 addresses intentional violations using sophisticated means with moderate skills. * SL 4 addresses highly sophisticated attackers with extended resources. Step 2: Match requirement to definition The question explicitly describes: * Intentional violations * Sophisticated means * Moderate skill level This description directly aligns with the formal definition of SL 3. Step 3: Why other SLs do not fit * SL 1 and SL 2 do not account for sophisticated attack techniques. * SL 4 assumes nation-state-level capability and extensive resources, which exceeds the stated threat. Step 4: Risk-based targeting ISA/IEC 62443-3-2 requires asset owners to select a Target Security Level (SL-T) based on risk assessment. When threats involve deliberate, technically capable attackers but not extreme resources, SL 3 is the appropriate target. Therefore, the correct and standards-aligned answer is SL 3.
Question 90
What is the purpose of ISO/IEC 15408 (Common Criteria)? Available Choices (select all choices that are correct)
Correct Answer: C
ISO/IEC 15408, also known as the Common Criteria for Information Technology Security Evaluation, is an international standard that provides a framework for evaluating the security of IT products and systems. The purpose of the standard is to define a common set of requirements for the security functions and assurance measures of IT products and systems, and to establish a common methodology for conducting security evaluations. The standard allows users to specify their security needs and expectations in a Security Target (ST), which may be based on one or more Protection Profiles (PPs) that define security requirements for a class of products or systems. Vendors can then implement or claim compliance with the ST or PPs, and have their products or systems evaluated by independent testing laboratories against the security criteria defined in the standard. The standard also defines a scale of Evaluation Assurance Levels (EALs) that indicate the degree of confidence in the security of the evaluated product or system. The standard is intended to facilitate the development, procurement, and use of secure IT products and systems, and to promote the recognition and acceptance of evaluation results across different countries and regions. References: ISO/IEC 15408-1:2009 - Common Criteria Evaluation for IT Security - Nemko1 Common Criteria - Wikipedia2 ISO/IEC Standard 15408 - ENISA3
