An internal audit of water-utility OT finds no defined vulnerability-management cadence for controllers and HMIs even though IT servers are scanned monthly. How should this audit result feed vulnerability management?
Select an answer to reveal the explanation.
Short Explanation
Audits are the flashlight on missing routines—if OT has no vuln cadence while servers get monthly scans, the fix is to extend the process, not shrug or stop scanning IT. Feed that audit finding straight into vuln-mgmt improvements.
Full Explanation
System and process audits are identification inputs that reveal gaps in vulnerability-management coverage and cadence. When internal audit finds water-utility OT controllers and HMIs lack a defined vuln process while IT servers are scanned monthly, the correct response is to extend inventory, risk ranking, patch/compensate workflows, and monitoring schedules into the OT estate—improving the program rather than arguing OT is exempt.
Ignoring OT because industrial devices “never need” vulnerability processes contradicts modern guidance and leaves safety-adjacent civic infrastructure blind. Treating the finding as a reason to stop IT scanning levels down instead of leveling OT up. Replacing all OT firmware immediately without inventory or prioritization risks operational outages and ignores change windows, vendor support, and compensating controls typical in OT.
Exam caveat: OT often needs softer scanning techniques, vendor-approved maintenance windows, and compensating network controls, but absence of any cadence is still a program failure. Audits identify process gaps; remediation must respect safety and availability.
Operational check: inventory OT assets and zones, define an OT-appropriate vuln cadence with engineering, prioritize internet-reachable or jump-host-adjacent devices first, document exceptions, and track audit closure with evidence of the new process.