ICS Legal Authority & Use of Force 2

Question 1

Under the Computer Fraud and Abuse Act (CFAA), which action by an ICS security professional would most likely constitute unauthorized access?

Accepted Answer

Scanning an ICS network segment not covered by their written authorization

Answer

The CFAA prohibits accessing computer systems without authorization, including ICS segments outside the scope defined in a written authorization agreement.

Question 2

Which federal law primarily governs cybersecurity requirements for critical infrastructure, including ICS environments, in the United States?

Accepted Answer

CISA 2022 (Cyber Incident Reporting for Critical Infrastructure Act)

Answer

CIRCIA 2022 established mandatory cyber incident reporting requirements for critical infrastructure sectors, including those operating ICS environments.

Question 3

A private security guard at a water treatment plant discovers an unauthorized person tampering with PLCs. Under what legal principle may the guard physically detain the individual?

Accepted Answer

Citizen's arrest authority under state law

Answer

Private security personnel may detain individuals under citizen's arrest provisions of applicable state law when witnessing a crime in progress.

Question 4

Which document formally defines the scope and limitations of a penetration tester's authority to test an ICS environment?

Accepted Answer

Rules of Engagement (ROE)

Answer

Rules of Engagement define the specific boundaries, methods, and limitations authorized for a penetration test, providing legal protection for the tester.

Question 5

An ICS operator at a power substation uses force to stop a physical intruder from accessing the control room. Which legal standard typically governs whether the force used was justified?

Accepted Answer

Force must be proportional to the threat presented

Answer

The proportionality doctrine requires that the level of force used be reasonably proportional to the level of threat posed by the intruder.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Legal Authority & Use of Force 2