ISA/IECISA/IEC 62443IEC 62443: Risk Assessment & Asset Owner RequirementsEASYFree question
An organization that performs risk assessments only once, at initial system commissioning, and never again is violating which CSMS principle?
- A.Risk assessment must be repeated when triggers occur and periodically thereafter
- B.Risk assessment should only ever be done once
- C.Risk assessment is the vendor's sole responsibility
- D.Risk assessment must be avoided in OT environments
Why A is correct
IEC 62443-2-1 treats risk assessment as a recurring activity driven by periodic review and by change triggers such as MOC and new threats. A one-time assessment grows stale as the environment and threats evolve. Continual reassessment is fundamental to a living CSMS.
Know someone studying for ISA/IEC 62443? Send them this one.