A water-utility SCADA vendor appliance is fragile; scanning policy and RoE require it to be excluded. What is the professional handling?
Select an answer to reveal the explanation.
Short Explanation
If the RoE says keep hands off the brittle plant gear, keep hands off. Write down what you could not test so the utility owns that leftover risk with eyes open.
Full Explanation
If scanning policy and RoE require excluding a fragile water-utility SCADA vendor appliance, honor the exclusion, avoid unsafe scans, and document residual untested risk for the client. Scanning it at maximum intensity to 'prove resilience' can cause operational harm. Silently skipping it while implying every system was tested misrepresents coverage. Replacing the appliance during the assessment without vendor involvement exceeds tester authority. Exam caveat: residual risk statements protect the utility when safety systems cannot be probed like ordinary IT. Operational check: list the appliance as exclusion with rationale, note alternate review options (vendor attestation, passive observation), obtain client acknowledgment, and keep scan profiles from targeting its addresses. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.