I85PREP
⌘ K
Lead SCADA Security Manager study materials
Lead SCADA Security Manager study resources

Lead SCADA Security Manager: Governance, Risk, and Compliance

Lead SCADA Security Manager · Work through your exam, one topic at a time.

All guide sections

Governance, Risk, and Compliance

This domain tests how you govern OT security, assess and treat risk, and demonstrate compliance without confusing a checklist with actual security. Expect questions on frameworks, risk registers, ownership, audits, and regulatory obligations.

Core rules

  • Know the main frameworks: IEC 62443 (2-1 management, 3-2 zones, 3-3 system requirements, 4-1/4-2 product), NIST SP 800-82 for OT guidance, the NIST Cybersecurity Framework for outcomes, ISO/IEC 27001:2022 for an ISMS, and ISO/IEC 27005 for risk technique. Sector rules may include NERC CIP, NIS2, and pipeline or water directives.
  • Run a repeatable risk process: identify assets and threats, analyze likelihood and impact, evaluate against criteria, treat (avoid, mitigate, transfer, accept), then monitor.
  • Record each risk with an owner, treatment, due date, residual score, and acceptance authority. A risk register without owners is decoration.
  • Map controls to multiple frameworks once, then reuse the evidence for audits and regulatory reporting.
  • Compliance is a floor, not a ceiling; a passed audit does not prove a zone is resilient to attack.

Worked example

An audit finds an unsupported PLC programming workstation. Reasoning: enter the risk with its zone, likelihood, safety and production impact, and current compensating controls. Treat by restricting network access, adding application allowlisting, and scheduling replacement in the next capital cycle. The asset owner accepts the residual risk in writing with a review date; the compliance team maps this evidence to IEC 62443-2-1 and the applicable regulator's requirement.

Traps that cost marks

  • Treating IEC 62443 certification as proof that every zone meets its target security level.
  • Maintaining a risk register that is never reviewed or lacks named owners.
  • Assuming one framework satisfies all regulators without mapping evidence.

Key points

  • IEC 62443, NIST SP 800-82, NIST CSF, and ISO/IEC 27001 serve different governance purposes.
  • Risk treatment options are avoid, mitigate, transfer, and accept.
  • Every risk needs an owner, treatment, date, residual score, and acceptance.
  • Map controls once and reuse evidence across audits.
  • Compliance does not equal security or resilience.
  • Sector regulators may impose prescriptive OT requirements beyond general frameworks.