CRISC Information Technology and Security Practice Question
Which standard is specifically designed for industrial automation and control systems security and provides a framework for addressing security in IACS?
⚠ Common exam trap
CRISC often tests the difference between general IT security standards (ISO 27001, NIST SP 800-53) and sector-specific or OT-specific standards (IEC 62443, NERC CIP), so candidates pick a well-known general standard instead of the IACS-specific one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IEC 62443
IEC 62443 is the international standard series specifically designed for industrial automation and control systems (IACS) security. It provides a framework for securing IACS across the entire lifecycle, including risk assessment, system design, and operational security, with roles defined for asset owners, system integrators, and product suppliers. It is the de facto standard for OT/ICS security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISO 27001
Why it's wrong here
ISO 27001 specifies requirements for an information security management system and is sector-agnostic, so it lacks IACS-specific control guidance. It is tempting because it is the best-known certifiable security standard and organisations often map OT controls onto it. IEC 62443 is purpose-built for industrial automation and control systems.
- ✗
NERC CIP
Why it's wrong here
NERC CIP applies only to the North American bulk electric system, so it does not cover industrial automation generally. It is tempting because it is an OT security standard, but its scope is mandatory reliability compliance for registered utilities. IEC 62443 provides the cross-sector IACS framework the question asks for.
- ✓
IEC 62443
Why this is correct
IEC 62443 is the only standard written specifically for industrial automation and control systems, defining security requirements across zones and conduits. It directly satisfies the stem's demand for an IACS-specific framework, unlike generic IT standards such as ISO 27001, which lack operational technology controls.
- ✗
NIST SP 800-53
Why it's wrong here
NIST SP 800-53 is a general catalogue of security and privacy controls for federal information systems, not an IACS-specific framework. It is tempting because it is comprehensive and widely adopted, and its controls can be tailored to OT. IEC 62443 addresses industrial automation and control systems security directly.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.