A manufacturing plant is developing a cybersecurity plan for its IACS that must evolve as new threats emerge and system changes occur. Which document should serve as the foundation for this evolving security approach?
Correct Answer: B
The Security Program (SP) portfolio is the correct foundational document for an evolving IACS cybersecurity approach according to the ISA/IEC 62443 family of standards. ISA/IEC 62443 is explicitly designed around the concept of continuous risk management and lifecycle-based cybersecurity, rather than static or one-time security implementations. Step 1: Role of the Security Program (SP) ISA/IEC 62443-2-1 defines the requirements for establishing, implementing, maintaining, and continuously improving an IACS Cybersecurity Management System. The Security Program provides organizational governance through policies, roles, responsibilities, procedures, training, incident handling, change management, and continuous improvement activities. These elements ensure cybersecurity adapts as threats, vulnerabilities, and system configurations evolve. Step 2: Need for an evolving security approach The standard recognizes that IACS environments are long-lived and subject to changing operational conditions, emerging threat actors, and new vulnerabilities. Therefore, cybersecurity must be managed as an ongoing process. The SP portfolio enables periodic reassessment of risks, updates to controls, and improvements to security processes throughout the system lifecycle. Step 3: Relationship between SP and SPS IEC 62443-2-2 introduces the Security Protection Scheme (SPS), which is a documented set of technical, procedural, and physical security measures selected to mitigate identified risks. However, the SPS is not the foundation; it is a product of the Security Program. The SP governs how the SPS is developed, implemented, operated, and modified over time. Step 4: Elimination of incorrect options * "IEC 62443-2-2 only" is insufficient because it addresses SPS development without broader governance. * Corporate KPIs unrelated to IACS do not manage cybersecurity risk. * An SPS alone cannot evolve without programmatic oversight. In alignment with the intent and structure of ISA/IEC 62443, the Security Program (SP) portfolio is the correct foundation for a cybersecurity plan that must continuously evolve.
Question 97
Which is the PRIMARY objective when defining a security zone? Available Choices (select all choices that are correct)
Correct Answer: B
According to the ISA/IEC 62443-3-2 standard, a security zone is a grouping of systems and components based on their functional, logical, and physical relationship that share common security requirements. The primary objective of defining a security zone is to apply a consistent level of protection to the assets within the zone, based on their criticality and risk assessment. A security zone may contain assets from different vendors, different levels in the Purdue model, or different physical locations, as long as they have the same security requirements. A security zone may also be subdivided into subzones, if there are different security requirements within the zone. A conduit is a logical or physical grouping of communication channels connecting two or more zones that share common security requirements. References: ISA/IEC 62443-3-2:2020, Security for industrial automation and control systems - Part 3-2: Security risk assessment for system design, Clause 4.3.21 ISA/IEC 62443-1-1:2009, Security for industrial automation and control systems - Part 1-1: Terminology, concepts and models, Clause 3.2.42
Question 98
Which of the following is an industry sector-specific standard? Available Choices (select all choices that are correct)
Correct Answer: C
API 1164 is an industry sector-specific standard that provides guidance on the cybersecurity of pipeline supervisory control and data acquisition (SCADA) systems. API stands for American Petroleum Institute, which is the largest U.S. trade association for the oil and natural gas industry. API 1164 was first published in 2004 and revised in 2009 and 2021. The latest version of the standard aligns with the ISA/IEC 62443 series of standards and incorporates the concepts of security levels, zones, and conduits. API 1164 covers the security lifecycle of pipeline SCADA systems, from risk assessment and policy development to implementation and maintenance. The standard also defines roles and responsibilities, security requirements, security controls, and security assessment methods for pipeline SCADA systems. References: API 1164: Pipeline SCADA Security, Fourth Edition, September 2021 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 2.2.2, Industry Sector-Specific Standards ISA/IEC 62443 Cybersecurity Fundamentals Specialist Exam Specification, Section 2.2.2, Industry Sector- Specific Standards
Question 99
What is one reason why IACS systems are highly vulnerable to attack?
Correct Answer: C
ISA/IEC 62443 highlights that many IACS environments operate with long lifecycles and strict availability requirements, which often results in delayed or infrequent patching. Step 1: Legacy systems and uptime constraints IACS components may run for decades without replacement. Applying patches can introduce operational and safety risks, so updates are often postponed. Step 2: Accumulated vulnerabilities Unpatched systems accumulate known vulnerabilities that attackers can exploit using publicly available tools. Step 3: Why other options are incorrect IACS systems are no longer isolated. They do require patches, and they rarely run the latest updates. Therefore, unpatched software is a major vulnerability factor.
Question 100
Which ISA/IEC 62443 part covers technical security requirements used by product suppliers, integration service providers, and asset owners?
Correct Answer: D
ISA/IEC 62443-4-2 specifies technical security requirements (TSRs) for individual IACS components such as: Embedded devices Software applications Network components Host devices These TSRs are relevant for product suppliers who design the components, integration service providers who implement them, and asset owners who operate them. "This standard specifies the technical security requirements for components used in an IACS, and is applicable to product suppliers, system integrators, and asset owners responsible for security implementation." - ISA/IEC 62443-4-2:2018, Clause 1 - Scope The 62443-3-3 standard complements it by specifying system-level requirements, while 62443-2-4 focuses on service providers and 62443-2-1 on security program management. References: ISA/IEC 62443-4-2:2018 - Clause 1 ISA/IEC 62443-4-2 - Table 1: Component types and SRs ISA/IEC 62443-1-1 - Roles and document mapping
