Legacy control server on a live automotive paint line
Ardent Components operates three automotive parts plants. A Windows Server 2008 R2 host runs the manufacturing execution system (MES) interface for Plant 2's paint line; the vendor will support it only until the line is replaced in 2028. The risk assessment scores the risk likelihood 4 and impact 5 because a 6-hour outage stops 1,100 vehicles' worth of parts and violates a customer's just-in-time contract with penalties of €180,000 per day. The plant director is the risk owner and wants to accept the risk because 'the line has run for 11 years without an incident'. The CISO's proposed €900,000 fix would replace the MES interface and require a 10-day shutdown; the board has approved only €250,000 for cyber treatment this year. Segmentation and 24/7 monitoring would cost €140,000 and reduce likelihood to 2, but not eliminate the safety consequence if the paint line's emergency stop network is reached. The risk acceptance criteria require any risk with safety consequences to be escalated to the executive committee, regardless of financial exposure.
1. Evaluate the risk against Ardent's acceptance criteria and determine who may accept it. Justify your answer.
Read the worked answer
Evaluation. Risk evaluation compares the analysed risk with the approved criteria. A likelihood of 4 and impact of 5 is above any reasonable financial threshold, and the scenario has a potential safety consequence because the paint line's emergency stop network could be reached. Under the stated criteria, that makes the risk unacceptable at plant level regardless of the financial exposure.
Acceptance authority. The plant director may be the risk owner accountable for treatment, but ownership is not the same as authority to accept. The criteria explicitly reserve any safety-consequence risk for the executive committee. The CISO can recommend and document, but cannot accept it alone. The executive committee must decide on interim residual risk, with a documented delegation and conditions.
Weigh the '11 years' argument. An incident-free period is not proof of low likelihood. It may reflect luck, weak detection, or a stable threat environment that has since changed. Review near misses, audit findings, vendor advisories, and the exposure of the MES to corporate and vendor networks. The correct conclusion is that treatment is required before acceptance can be considered, and that interim acceptance must be time-bound, conditional, and escalated. Record the rationale and the decision authority.
2. Compare treatment options and recommend a course of action within the €250,000 budget.
Read the worked answer
Modify. Segmentation plus 24/7 monitoring at €140,000 reduces likelihood to 2 but leaves impact at 5 because the safety consequence remains. Add emergency-stop network segregation, restricted vendor access, hardened local accounts, offline backups, spare hardware, and an OT incident playbook. These may fit within the remaining €110,000 if prioritised, but a safety-engineering review is needed before claiming the consequence is reduced.
Avoid. Early replacement or decommissioning the line removes the risk but is not feasible before 2028 on current plans and would create major production and contractual disruption. Disconnecting the MES from the corporate network may avoid some paths, but it can break business integration and must be assessed with operations.
Share/transfer. Insurance and contractual remedies may cover financial loss, but they do not transfer safety, regulatory, or customer accountability.
Retain. Retention is not 'do nothing'. It requires executive acceptance of the residual risk, with treatment and monitoring in place.
Recommendation. Implement the €140,000 segmentation and monitoring immediately, fund the safety-network review and incident readiness from the remainder, and start a business case for the 2028 replacement. Seek executive-committee acceptance of the interim residual risk, with conditions, review dates, and a trigger to escalate if monitoring fails or the vendor withdraws support.
3. What should the risk treatment plan contain, and how should residual risk be recorded and monitored?
Read the worked answer
Treatment plan. Include the risk ID and scenario, risk owner, chosen options and justification, specific actions, milestones, resources and budget, dependencies (production windows, vendor cooperation), expected risk reduction, acceptance authority, residual-risk estimate, monitoring indicators, review dates, and evidence requirements. Link actions to the ISMS controls and the Statement of Applicability where applicable.
Residual risk record. State the residual rating explicitly: for example, likelihood 2, impact 5, with a safety consequence; accepted by the executive committee on a specific date, subject to segmentation, 24/7 monitoring, and emergency-stop segregation. Record the conditions and the person accountable for maintaining them. If a condition lapses, the acceptance should be treated as invalid and the risk re-escalated.
Monitoring. Track monthly vulnerability status, vendor support notices, monitoring coverage and alerts, patch exceptions, incident and near-miss trends, and the status of the replacement business case. Reassess at planned intervals and on triggers such as a new threat, a change to the line, a vendor support change, or an audit finding. Keep the treatment tracker and minutes as evidence; an accepted risk is still a managed risk.