Mixed Deck — All ISP Topics Flashcards

In an industrial security context, 'data at rest' refers to:

Answer: Stored data on drives, servers, or removable media not currently in transit

Data at rest encompasses all stored information that is not actively moving through a network or being processed.

What is a 'counterfeit part' in the context of supply chain security?

Answer: An item that is a copy, imitation, or substitute that has been misrepresented as genuine

A counterfeit part is misrepresented as genuine or authorized, posing safety and security risks especially in critical industrial systems.

How do physical barriers contribute to facility protection?

Answer: By blocking unauthorized access to sensitive areas

Physical barriers, such as fences, walls, gates, and reinforced doors, create tangible obstacles to entry. They are specifically designed to delay, deter, or prevent unauthorized individuals from gaining access to a facility or specific secure zones within it. These barriers form a crucial first line of defense in a layered security strategy.

During a declared emergency at an industrial facility, mutual aid agreements with neighboring facilities and local agencies are MOST valuable because they:

Answer: Provide pre-authorized access to additional resources when internal capacity is exceeded

Mutual aid agreements pre-authorize resource sharing—personnel, equipment, supplies—ensuring help is available quickly when the facility's own capacity is overwhelmed.

A contractor wants to submit clearance requests for new hires 'just in case' a future contract requires access. Is this allowed?

Answer: No, clearances may be requested only when there is a bona fide need for access

Contractors may request PCLs only for employees with a current, legitimate need to access classified information.

A contractor holding foreign government information (FGI) receives a request to share it with a third country. What is required?

Answer: Consent of the originating foreign government

FGI may not be released to a third country or third party without the prior consent of the originating government.

The 'Security In Depth' training concept teaches employees to:

Answer: Apply multiple overlapping security behaviors so the failure of one control is caught by another

Defense-in-depth training reinforces that no single control is perfect and that layered behaviors provide resilience against security failures.

What is the primary goal of physical security in facility protection?

Answer: To protect facilities and assets from physical threats

Physical security is specifically designed to protect tangible assets, personnel, and the physical environment from harm. Its primary objective is to prevent unauthorized access, theft, vandalism, and other physical threats that could disrupt operations or compromise safety. This ensures the integrity and continuous operation of the facility and its valuable contents.

Which of the following is generally EXCLUDED from the ITAR definition of technical data?

Answer: Information in the public domain

ITAR excludes public domain information, general scientific principles, and basic marketing information from technical data.

Which industrial control system (ICS) protocol is most commonly targeted by adversaries due to its lack of built-in authentication?

Answer: Modbus

Modbus was designed for reliability in isolated networks and lacks authentication, making it vulnerable when exposed to broader networks.

What is the importance of security policy enforcement?

Answer: To ensure that security measures are followed consistently

Policy enforcement translates written security policies into actionable and consistently followed practices. Without consistent enforcement, policies become ineffective, creating vulnerabilities that can be exploited by malicious actors. It ensures accountability, reinforces the importance of security, and guarantees that all employees adhere to the established rules and procedures, thereby strengthening the overall security posture.

The Purdue Model (Industrial Automation and Control Systems reference architecture) is PRIMARILY used to:

Answer: Define network segmentation zones and security boundaries between IT and OT systems

The Purdue Model provides a hierarchical framework for segmenting industrial networks into zones from the enterprise level down to field devices, enabling security boundary definition.

Which policy governs the release of classified military information to foreign governments and international organizations?

Answer: National Disclosure Policy (NDP-1)

NDP-1 sets out the criteria and limits for disclosing classified military information to foreign governments.

Which three lines make up the classification authority block on a derivatively classified document?

Answer: Classified By, Derived From, Declassify On

Derivative documents carry Classified By, Derived From, and Declassify On lines; the Reason line belongs to original decisions.

What is the primary purpose of a Plan of Action and Milestones (POA&M) for an information system?

Answer: Track identified weaknesses and the planned schedule to remediate them

A POA&M documents vulnerabilities, required corrective actions, resources, and completion dates.

Which standard form is used to record the opening, closing, and checking of a security container each day?

Answer: SF 702

The SF 702 Security Container Check Sheet records each opening, closing, and check of a container.

Which FOCI mitigation instrument is typically used when a foreign interest does NOT own voting stock sufficient to elect a board representative?

Answer: Board Resolution

A Board Resolution is the least restrictive measure, used when the foreign interest cannot elect a representative to the board.

Which standard form label is used to mark removable media containing Secret information?

Answer: SF 707

The SF 707 is the Secret media label; the SF 706 is Top Secret, SF 708 Confidential, and SF 710 Unclassified.

When an industrial facility activates its emergency plan due to a natural disaster, the Emergency Support Functions (ESFs) framework used in coordination with government agencies is defined under:

Answer: The National Response Framework (NRF)

The National Response Framework organizes federal emergency support into 15 Emergency Support Functions that coordinate government and private sector response to major disasters.

Which NIST publication specifies requirements for protecting Controlled Unclassified Information (CUI) on nonfederal contractor systems?

Answer: NIST SP 800-171

NIST SP 800-171 sets the security requirements DFARS 252.204-7012 requires for CUI on contractor systems.