During an ICS security incident, the operations team insists on maintaining production while the security team wants to isolate affected systems. What is the BEST approach to resolve this conflict?
-
A
Convene a joint risk assessment with both teams to evaluate production impact versus security exposure
-
B
Always defer to the operations team since uptime is the primary ICS objective
-
C
Escalate immediately to legal counsel to determine liability
-
D
Allow the security team to isolate systems without operations team input