ICS Security Standards and Compliance Frameworks 4

Question 1

Which compliance requirement under NERC CIP-010 involves documenting baseline configurations for BES cyber systems?

Accepted Answer

Configuration change management

Answer

NERC CIP-010 requires organizations to establish and document baseline configurations for BES cyber systems and manage any deviations through a formal change management process.

Question 2

The NIST Cybersecurity Framework (CSF) 2.0 added which new core function compared to CSF 1.1?

Accepted Answer

Govern

Answer

CSF 2.0 introduced the 'Govern' function, emphasizing that cybersecurity risk management decisions, expectations, and policy must be established and monitored at the organizational level.

Question 3

In ICS security, what does 'defense in depth' primarily refer to?

Accepted Answer

Layering multiple independent security controls so no single failure causes a breach

Answer

Defense in depth in ICS security means layering complementary security controls (physical, network, host, and procedural) so attackers must defeat multiple independent barriers.

Question 4

Which NERC CIP standard specifically governs supply chain risk management for industrial control system hardware and software?

Accepted Answer

CIP-013

Answer

NERC CIP-013 requires utilities to develop and implement supply chain risk management plans for hardware, software, and services used in BES cyber systems.

Question 5

Under the NIST SP 800-53 control family, which control family is MOST directly applicable to ICS physical access to control rooms?

Accepted Answer

Physical and Environmental Protection (PE)

Answer

The Physical and Environmental Protection (PE) control family in NIST SP 800-53 addresses physical access controls, monitoring, and protection of facilities housing information systems.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Security Standards and Compliance Frameworks 4