Risk Assessment and Compliance
Domain 5 tests risk assessment methods, security-level thinking, and the standards and regulations that shape PCN compliance.
Core rules
- IEC 62443 risk assessment identifies zones and conduits, sets target security levels (SL-T), compares achieved SL, and records gaps.
- HAZOP and LOPA focus on process safety; cyber risk assessment adds threat, vulnerability, and cyber consequence.
- NIST SP 800-82 guides OT security; NERC CIP applies to bulk electric systems; TSA directives apply to pipelines; IEC 62443 provides industrial security standards.
- Compliance is a floor, not a complete risk picture. Document exceptions, compensating controls, and residual risk.
- Risk combines likelihood and consequence, but OT consequence includes safety, environment, production loss, and regulatory impact.
Worked example
An unpatched HMI with a known remote-code-execution flaw is reachable from Level 3. Likelihood is medium because of segmentation; consequence is high because the HMI controls chemical feed. Risk is high. Options include further segmentation, restricting RDP, allowlisting, and emergency patching. Reasoning: CVSS alone would overstate network exposure or understate physical impact.
Traps
Ranking risk by CVSS only; assuming a compliance checklist means secure; ignoring physical and insider threats; forgetting supply-chain risk; treating a safety study as a cyber risk assessment.