A risk assessment is carried out to identify and evaluate the risks to the confidentiality, integrity, and availability of IACS systems (including their supporting systems).
The risk assessment must cover all IACS assets (as appropriate) including networks, devices, hardware, software, and data assets. It must be carried out by individuals with the necessary competence.
It must include:
- Identifying vulnerabilities and threats
- Estimating risk levels (impact and likelihood)
- Prioritising risks according to their level
- Consequences of the risks materializing including financial losses and impacts to the organization HSE
The organization should ensure that assessments are carried out at every stage of the technology lifecycle, including development, implementation, modifications, and retirement.
