問題文
A team is told that the model does not address operational technology or certain classes of connected devices. How should a plant with such systems proceed?
選択肢
- It should recognize that the model is not intended to be exclusionary but does not address the challenges specific to those systems, so decisions there rest on risk, mission, requirements, and operating constraints.
- It should wait for a supplementary model covering operational technology, because the guidance states that such a model is under development and applying the general one before it is published would create controls that would have to be reworked.
- It should exclude those systems from the architecture entirely, since the model does not describe how to mature them within any of the five pillars it defines.
- It should apply the identity pillar's functions to those systems unchanged, since a control system has an identity like any other asset that the enterprise happens to own and operate.