ISA 62443 IC33 4 CYBER RISK
ASSESSMENT QUESTIONS AND
ANSWERS
Understanding8Cybersecurity8Risk8-8ans-
The8process8of8comprehending8cybersecurity8risk8involves8determining8realistic8t
hreats,8identifying8existing8vulnerabilities8and8critical8assets,8understanding8the8p
otential8consequences8of8compromise,8and8assessing8the8effectiveness8of8curren
t8safeguards.
Developing8a8Plan8to8Address8Unacceptable8Risk8-8ans-
This8involves8evaluating8existing8countermeasures,8recommending8additional8ones
8and8changes8to8current8policies,8prioritizing8recommendations8based8on8relative
8risk,8and8assessing8the8balance8between8cost/complexity8and8effectiveness.
Benefits8of8Cyber8Risk8Assessments8-8ans-Helps8determine8priority8plants/
processes,8understand8threats8and8vulnerabilities,8intelligently8design8and8apply8
countermeasures8to8reduce8risk,8prioritize8activities8and8resources,8and8evaluate
8countermeasures8based8on8their8effectiveness8versus8cost/complexity.
Balancing8Security8and8Cost8-8ans-
Perfect8security8is8unaffordable.8Thus,8risk8reduction8is8balanced8against8the8co
st8of8security8measures8intended8to8mitigate8the8risk.
4.2.3.18Select8a8risk8assessment8methodology8-8ans-
The8organization8shall8select8a8particular8risk8assessment8and8analysis8approac
h8and8methodology8that8identifies8and8prioritizes8risks8based8upon8security8thre
ats,8vulnerabilities8and8consequences8related8to8their8IACS8assets.
4.2.3.28Provide8risk8assessment8background
Information8-8ans-
The8organization8should8provide8participants8in8the8risk8assessment8activity8with
8appropriate
information8including8methodology8training,8before8beginning8to8identify8the8risks.
4.2.3.38Conduct8a8high-level8risk8assessment8-8ans-A8high-
level8system8risk8assessment8shall8be8performed8to8understand8the8financial8an
d8HS&E8consequences8in8the8event8that8availability,8integrity,8or8confidentiality8
of8the8IACS8is8compromised.
, 4.2.3.48Identify8the8industrial8automation8and8control8systems8-8ans-
The8organization8shall8identify8the8various8IACS,8gather8data8about8the8devices
8to8characterize8the8nature8of8the8security8risk,8and8group8the8devices8into8log
ically8integrated8systems.
Risk8Identification,8Classification,8and8Assessment8-8ans-
A8systematic8process8to8identify8and8assess8the8severity8of8IACS8cyber8risks8
an8organization8faces.8It8involves8prioritizing8and8analyzing8potential8threats,8vul
nerabilities,8and8consequences.8The8objective8is8to8guide8cybersecurity8investme
nts8to8lower8risk.
4.2.3.58Develop8simple8network8diagrams8-8ans-
The8organization8shall8develop8simple8network8diagrams8for8each8of8the8logicall
y8integrated8systems8showing8the8major8devices,8network8types,8and8general8lo
cations8of8the8equipment.
4.2.3.68Prioritize8systems8-8ans-
The8organization8shall8develop8the8criteria8and8assign8a8priority8rating8for8mitig
ating8the8risk8of8each8logical8control8system.
4.2.3.78Perform8a8detailed8vulnerability8assessment8-8ans-
The8organization8shall8perform8a8detailed8vulnerability8assessment8of8its8individu
al8logical8IACS,8which8may8be8scoped8based8on8the8high-
level8risk8assessment8results8and8prioritization8of8IACS8subject8to8these8risks.
4.2.3.88Identify8a8detailed8risk8assessment8methodology8-8ans-
The8organization's8risk8assessment8methodology8shall8include8methods8for8priorit
izing8detailed8vulnerabilities8identified8in8the8detailed8vulnerability8assessment.
4.2.3.98Conduct8a8detailed8risk8assessment8-8ans-
The8organization8shall8conduct8a8detailed8risk8assessment8incorporating8the8vul
nerabilities8identified8in8the8detailed8vulnerability8assessment.
4.2.3.108Identify8the8reassessment8frequency8and8triggering8criteria8-8ans-
The8organization8shall8identify8the8risk8and8vulnerability8reassessment8frequency
8as8well8as8any8reassessment8triggering8criteria8based8on8technology,8organizat
ion,8or8process8changes.
4.2.3.118Integrate8physical,8HSE8and8Cybersecurity8risk8assessment8results8-
8ans-
The8results8of8physical,8HSE8and8Cybersecurity8risk8assessments8shall8be8integ
rated8to8understand8the8assets'8overall8risk.
4.2.3.128Conduct8risk8assessments8throughout8the8lifecycle8of8the8IACS8-8ans-
Risk8assessments8shall8be8conducted8through8all8stages8of8the8technology8lifec
ycle8including8development,8implementation,8updates,8and8retirement.
ASSESSMENT QUESTIONS AND
ANSWERS
Understanding8Cybersecurity8Risk8-8ans-
The8process8of8comprehending8cybersecurity8risk8involves8determining8realistic8t
hreats,8identifying8existing8vulnerabilities8and8critical8assets,8understanding8the8p
otential8consequences8of8compromise,8and8assessing8the8effectiveness8of8curren
t8safeguards.
Developing8a8Plan8to8Address8Unacceptable8Risk8-8ans-
This8involves8evaluating8existing8countermeasures,8recommending8additional8ones
8and8changes8to8current8policies,8prioritizing8recommendations8based8on8relative
8risk,8and8assessing8the8balance8between8cost/complexity8and8effectiveness.
Benefits8of8Cyber8Risk8Assessments8-8ans-Helps8determine8priority8plants/
processes,8understand8threats8and8vulnerabilities,8intelligently8design8and8apply8
countermeasures8to8reduce8risk,8prioritize8activities8and8resources,8and8evaluate
8countermeasures8based8on8their8effectiveness8versus8cost/complexity.
Balancing8Security8and8Cost8-8ans-
Perfect8security8is8unaffordable.8Thus,8risk8reduction8is8balanced8against8the8co
st8of8security8measures8intended8to8mitigate8the8risk.
4.2.3.18Select8a8risk8assessment8methodology8-8ans-
The8organization8shall8select8a8particular8risk8assessment8and8analysis8approac
h8and8methodology8that8identifies8and8prioritizes8risks8based8upon8security8thre
ats,8vulnerabilities8and8consequences8related8to8their8IACS8assets.
4.2.3.28Provide8risk8assessment8background
Information8-8ans-
The8organization8should8provide8participants8in8the8risk8assessment8activity8with
8appropriate
information8including8methodology8training,8before8beginning8to8identify8the8risks.
4.2.3.38Conduct8a8high-level8risk8assessment8-8ans-A8high-
level8system8risk8assessment8shall8be8performed8to8understand8the8financial8an
d8HS&E8consequences8in8the8event8that8availability,8integrity,8or8confidentiality8
of8the8IACS8is8compromised.
, 4.2.3.48Identify8the8industrial8automation8and8control8systems8-8ans-
The8organization8shall8identify8the8various8IACS,8gather8data8about8the8devices
8to8characterize8the8nature8of8the8security8risk,8and8group8the8devices8into8log
ically8integrated8systems.
Risk8Identification,8Classification,8and8Assessment8-8ans-
A8systematic8process8to8identify8and8assess8the8severity8of8IACS8cyber8risks8
an8organization8faces.8It8involves8prioritizing8and8analyzing8potential8threats,8vul
nerabilities,8and8consequences.8The8objective8is8to8guide8cybersecurity8investme
nts8to8lower8risk.
4.2.3.58Develop8simple8network8diagrams8-8ans-
The8organization8shall8develop8simple8network8diagrams8for8each8of8the8logicall
y8integrated8systems8showing8the8major8devices,8network8types,8and8general8lo
cations8of8the8equipment.
4.2.3.68Prioritize8systems8-8ans-
The8organization8shall8develop8the8criteria8and8assign8a8priority8rating8for8mitig
ating8the8risk8of8each8logical8control8system.
4.2.3.78Perform8a8detailed8vulnerability8assessment8-8ans-
The8organization8shall8perform8a8detailed8vulnerability8assessment8of8its8individu
al8logical8IACS,8which8may8be8scoped8based8on8the8high-
level8risk8assessment8results8and8prioritization8of8IACS8subject8to8these8risks.
4.2.3.88Identify8a8detailed8risk8assessment8methodology8-8ans-
The8organization's8risk8assessment8methodology8shall8include8methods8for8priorit
izing8detailed8vulnerabilities8identified8in8the8detailed8vulnerability8assessment.
4.2.3.98Conduct8a8detailed8risk8assessment8-8ans-
The8organization8shall8conduct8a8detailed8risk8assessment8incorporating8the8vul
nerabilities8identified8in8the8detailed8vulnerability8assessment.
4.2.3.108Identify8the8reassessment8frequency8and8triggering8criteria8-8ans-
The8organization8shall8identify8the8risk8and8vulnerability8reassessment8frequency
8as8well8as8any8reassessment8triggering8criteria8based8on8technology,8organizat
ion,8or8process8changes.
4.2.3.118Integrate8physical,8HSE8and8Cybersecurity8risk8assessment8results8-
8ans-
The8results8of8physical,8HSE8and8Cybersecurity8risk8assessments8shall8be8integ
rated8to8understand8the8assets'8overall8risk.
4.2.3.128Conduct8risk8assessments8throughout8the8lifecycle8of8the8IACS8-8ans-
Risk8assessments8shall8be8conducted8through8all8stages8of8the8technology8lifec
ycle8including8development,8implementation,8updates,8and8retirement.
