A water utility depends on one SCADA technician who alone can restart the control network. Leadership labels the issue 'technology risk only.' What is the more accurate primary classification?
Select an answer to reveal the explanation.
Short Explanation
It's like having one locksmith for the whole city hall—when that person is out, the high-tech locks don't help. Key-person dependency is mainly personnel risk. The SCADA gear is the setting, not the whole story.
Full Explanation
When a water utility depends on a single SCADA technician who alone can restart the control network, the primary classification is personnel key-person risk even though the asset is technical. The fragility sits in concentrated human capability: illness, departure, or unavailability immediately threatens continuity of a civic control system. Labeling the issue technology-only understates the people dependency and steers treatment toward hardware refresh instead of succession, cross-training, and documented runbooks. Market-pricing of spare parts is a related but secondary financial concern and does not explain single-operator restart dependency. Environmental runoff at chemical sheds is a different source category and does not address control-network restart ownership. Visitor wayfinding on a lobby checklist is unrelated to industrial control continuity. Exam caveat: hybrid exposures are common—technology and people often co-exist—but exam items ask for the primary driver of the stated vulnerability. Operational check: name backups, document restart procedures offline from one person’s memory, schedule shadow shifts, and test that a second qualified person can restore SCADA functions within the recovery objective used by the utility’s continuity plan.