In terms of availability requirements, how do IACS and IT differ?
Correct Answer: D
The ISA/IEC 62443 standards explain that continuous operation is often required in IT systems (such as data centers and online services), but for IACS environments, scheduled operation (for example, planned maintenance windows) is typically sufficient. IACS systems may accept limited downtime for maintenance, but require high availability during production runs. Reference: ISA/IEC 62443-1-1:2007, Section 4.4.4 ("Availability in IACS and IT contexts"); Table 7 (Comparison of IT and IACS requirements).
Question 117
What programs are MOST effective if they are tailored to the audience, consistent with company policy, and communicated regularly?
Correct Answer: B
Cybersecurity awareness programs are critical for ensuring that all personnel understand and follow security practices. To be effective, these programs must be: Tailored to roles and responsibilities Aligned with company policies Communicated regularly and reinforced "An effective cybersecurity awareness program is audience-specific, policy-aligned, and continuously reinforced to ensure long-term behavioral change." - ISA/IEC 62443-2-1:2010, Clause 4.3.3 - Security Training and Awareness These programs are part of the organization's security governance and are essential for building a security- focused culture. References: ISA/IEC 62443-2-1:2010 - Clause 4.3.3 ISA/IEC 62443-1-1 - Organizational requirements for awareness
Question 118
Which policies and procedures publication is titled Patch Manaqement in the IACS Environment? Available Choices (select all choices that are correct)
Correct Answer: B
Question 119
If a U.S. federal agency must comply with mandatory cybersecurity requirements under law, which document would they be required to follow?
Correct Answer: A
For U.S. federal agencies, compliance with cybersecurity requirements is mandated under the Federal Information Security Modernization Act (FISMA). Under this act, agencies are required by law to adhere to NIST Federal Information Processing Standards (FIPS). From NIST documentation and FISMA: "Federal agencies must comply with the standards and guidelines developed by NIST, including FIPS 199 and FIPS 200, to ensure appropriate levels of information security." NIST FIPS documents are mandatory for federal agencies, while NIST Special Publications (e.g., SP 800- 171) are recommended or apply to non-federal entities (like contractors). Incorrect Options: B). ISA/IEC 62443 - While globally recognized, ISA/IEC 62443 is not mandated by U.S. federal law. C). EU Cyber Resilience Act - Applies only to European Union entities. D). NIST SP 800-171 - Applies to defense contractors, not directly to federal agencies. References: FISMA (Federal Information Security Modernization Act) NIST FIPS 199, FIPS 200 ISA/IEC 62443 Study Guide (Context: Applicability and comparison with NIST standards)
Question 120
What must be established as part of the risk assessment process?
Correct Answer: C
The ISA/IEC 62443-3-2 standard specifies that a key output of the risk assessment process is the establishment of Target Security Levels (SL-Ts) for each security zone or conduit. These target levels define the minimum cybersecurity requirements necessary to mitigate identified risks to an acceptable level. Total risk elimination is generally not possible; instead, setting SL-Ts allows for structured, risk-based implementation of security controls. Reference: ISA/IEC 62443-3-2:2020, Section 5.4.4 ("Assignment of Target Security Levels").
