What are the typical steps in conducting a risk assessment for cyber-physical systems?

• A. Provide incident response playbooks to the team.
• B. Identify assets, threats, vulnerabilities; calculate risk.
• C. Only patch known vulnerabilities after a breach.
• D. Ignore risk matrices and rely on chance.

Answer: (B)

Falling into place, the main idea is to follow a structured risk assessment: start by identifying what you have (assets such as sensors, controllers, networks, and data), then determine what could threaten those assets (threats), and what weaknesses could be exploited (vulnerabilities). After that, you estimate risk by considering how likely a threat is to exploit a vulnerability and what the impact would be on the asset. This combination—likelihood and impact—lets you prioritize where to focus protection efforts and mitigations.

In a cyber-physical system, understanding assets helps you see what would be most disruptive if compromised. Threats can be both cyber (malware, intrusion, spoofing) and physical (tampering, environmental hazards), while vulnerabilities might include unpatched software, weak access controls, or insecure communication protocols. Once risk is quantified or scored, you can target the highest-priority risks with appropriate controls, monitoring, and response plans.

Incident response playbooks are useful for guiding action after an incident, not for the initial assessment of risk. Patching only after a breach is a reactive stance that misses the proactive identification and prioritization of risks. Ignoring risk matrices and relying on chance eliminates the quantitative basis that helps compare and rank different risk scenarios.