A water utility is standing up Advanced Risk assessments for operational-technology assets and needs likelihood and impact factors weighted for OT criticality. Where should those factors and weights live?
Select an answer to reveal the explanation.
Short Explanation
OT risk scoring needs a recipe card — which ingredients matter and how heavy each is. Put factors and weights in the advanced assessment methodology tuned for OT, not in private notebooks. Discovery probes and SIR playbooks are different kitchens.
Full Explanation
OT-appropriate likelihood and impact factors and weights for water-utility Advanced Risk assessments belong in the advanced assessment methodology configured for OT criticality. Methodology is the governed recipe card: which factors matter and how heavily each weighs for plant assets. Consistent OT scoring across assessors depends on that shared configuration, not private notebooks.
Keeping scales only in each assessor’s private notebook intentionally destroys comparability. Hard-coded SIR playbook steps that replace risk assessment entirely relocate the problem into incident response and abandon Advanced Risk methodology. CMDB discovery probes that auto-write residual scores without a methodology confuse inventory discovery with assessed residual judgment.
Exam caveat: Advanced Risk methodologies hold factors/weights; discovery and SIR playbooks are different planes. CIS-RC OT items expect methodology configuration.
Operational check: open the OT advanced methodology; confirm factors and weights reflect OT criticality; run a sample assessment; ensure residuals derive from methodology, not probe auto-writes or personal scales.
Weight choices for OT should be approved by plant and safety stakeholders, not only IT GRC admins, so industrial consequence is reflected honestly. Version the methodology when weights change and communicate the effective date to assessors. Prohibit personal notebooks as scoring sources in the OT assessment SOP.