When selecting a risk assessment methodology for a complex industrial automation system, which approach aligns BEST with ISA/IEC 62443 guidance?
Correct Answer: C
ISA/IEC 62443-3-2 intentionally avoids mandating a single risk assessment methodology. Instead, it defines requirements for the outcome and consistency of the risk assessment process. Step 1: Methodology flexibility The standard allows asset owners to use qualitative, quantitative, or hybrid methods based on system complexity, organizational maturity, and available data. Step 2: Consistency requirement What ISA/IEC 62443 does require is that the methodology be documented, repeatable, and consistent, particularly in how risks are ranked and compared. Step 3: Security Level determination Consistent risk ranking is essential for determining Target Security Levels (SL-T) and for justifying security decisions during audits. Step 4: Why other options are incorrect Avoiding standards undermines rigor. Using only qualitative methods may be insufficient. Mixing methodologies can introduce inconsistency and invalidate comparisons. Therefore, the approach that best aligns with ISA/IEC 62443 is to follow any documented methodology that uses a consistent risk ranking scale.
Question 137
What is the primary goal of the Assess phase in the IACS Cybersecurity Lifecycle?
Correct Answer: C
In the Assess phase of the IACS Cybersecurity Lifecycle (as defined in ISA/IEC 62443-2-1 and 62443-3-2), the main objective is to identify assets, analyze risks, and assign a Target Security Level (SL-T) for each zone or conduit. This sets the foundation for design and implementation decisions. Achieving or verifying the SL- A (Achieved Security Level) occurs later in the lifecycle, after implementation. Reference: ISA/IEC 62443-2-1:2009, Section 5.2; ISA/IEC 62443-3-2:2020, Section 5 ("Risk assessment and SL-T assignment").
Question 138
What do packet filter firewalls examine? Available Choices (select all choices that are correct)
Correct Answer: B
Question 139
Which is a reason for and physical security regulations meeting a mixed resistance? Available Choices (select all choices that are correct)
Correct Answer: B
Question 140
Which of the following is the BEST reason for periodic audits? Available Choices (select all choices that are correct)
