SCADA historian servers and lobby information kiosks are inventoried under one generic 'IT equipment' class with identical controls. What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
A historian that keeps the plant honest isn't a lobby kiosk with bus schedules. Asset classification grades criticality and sensitivity so the heavy hitters get heavier armor. One generic 'IT stuff' bucket flattens risk that isn't flat.
Full Explanation
Assets should be classified by criticality and sensitivity so high-impact systems such as SCADA historian servers receive stronger controls than low-impact lobby information kiosks. Inventoring both under one generic 'IT equipment' class with identical controls either overcontrols kiosks at unnecessary cost or, more dangerously, underprotects historians that support industrial operations and safety-related visibility. Keeping one class for identical patching calendars ignores differential risk and operational constraints on OT. Reclassifying kiosks as SCADA to inherit industrial trust wrongly expands the OT trust domain. Removing historians from inventory because OT is 'not an information asset' leaves critical systems unmanaged. Exam caveat: CISSP asset classification supports proportionate protection—criticality and sensitivity drive control baselines. Operational check: split asset inventories into classes reflecting impact (e.g., OT/SCADA, business critical, end-user/public kiosk), assign control baselines per class, and align patching, monitoring, and access reviews accordingly. Validate that historians have stricter network segmentation, logging, and change control than lobby kiosks, and review classification when systems are repurposed.