Certified Information Security Manager (CISM)Incident ManagementHard
A global manufacturing company experiences a cyber-physical incident where ransomware encrypts critical production control systems (OT network), halting operations. The CISO, working with the OT security team, needs to prioritize recovery efforts to minimize production downtime. Which of the following should be the PRIMARY consideration when prioritizing the recovery of OT systems?
- ARecovering systems with the lowest Recovery Point Objective (RPO).
- BFocusing on systems critical for safety and environmental protection.
- CPrioritizing systems that process customer financial data.
- DRestoring systems that have the highest data confidentiality requirements.
Show answer & explanationAnswer & explanation
Correct answer: B. Focusing on systems critical for safety and environmental protection.
In an OT environment, human safety and environmental protection are paramount. Any incident affecting production control systems must first prioritize restoring functions that prevent harm to personnel, the public, or the environment, even above immediate production or data recovery.
Why the other options are wrong
- A. RPO focuses on data loss, which is important, but not as critical as safety when dealing with cyber-physical systems that can cause physical harm.
- C. Customer financial data is typically IT-related; the question specifies 'production control systems (OT network)', making this less relevant to the primary OT recovery priority.
- D. Confidentiality, while important, is secondary to safety in an OT environment where physical harm is a risk.
OT Incident Recovery Priority
In Operational Technology (OT) environments, recovery efforts are primarily prioritized based on ensuring human safety, environmental protection, and then operational continuity.
- Safety of personnel and public is paramount.
- Protection of the environment is a critical concern.
- Operational continuity follows safety and environmental considerations.
Memory trick: In OT, Safety First, then Environment, then Operations.