ICS Report Writing & Documentation 2

Question 1

When documenting an ICS incident, what is the primary purpose of a chain-of-custody log?

Accepted Answer

To track who accessed or handled evidence to preserve its integrity

Answer

Chain-of-custody logs ensure evidence integrity by recording every person who handled evidence, which is critical for legal proceedings.

Question 2

Which section of an ICS security assessment report typically describes the methodology and tools used during testing?

Accepted Answer

Assessment Methodology

Answer

The Assessment Methodology section details the techniques, tools, and procedures used so stakeholders can evaluate the assessment's rigor.

Question 3

A security analyst must report a vulnerability in a SCADA system to a federal regulator. Which document format is most appropriate?

Accepted Answer

Structured incident report following NERC CIP or sector-specific regulatory template

Answer

Federal regulatory submissions require structured formats aligned with applicable standards like NERC CIP to ensure completeness and legal compliance.

Question 4

What does 'impact assessment' mean in the context of an ICS security report?

Accepted Answer

Evaluating how a vulnerability or incident affects safety, operations, and data integrity

Answer

Impact assessment evaluates the operational, safety, and data-integrity consequences of a security event to prioritize response and remediation.

Question 5

Which element is MOST critical to include when documenting ICS network topology changes for audit purposes?

Accepted Answer

Date, authorized approver, and before/after configuration details

Answer

Audit-ready change documentation must include timestamps, authorization records, and configuration deltas to establish accountability.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Report Writing & Documentation 2