Lead SCADA Security Manager Training — Lesson 2: Directing Threats, Vulnerabilities, Risk, Zones, Conduits, and Security Levels

Learning Objectives

• Interpret the purpose, responsibilities, inputs, and decision points shaping directing threats, vulnerabilities, risk, zones, conduits, and security levels.
• Apply the workflow and produce industrial risk and architecture register that another practitioner can review.
• Analyze “a security level is selected without consequence analysis” and recommend a proportionate, evidence-based response.

Detailed Topics

• threat scenarios
• vulnerability analysis
• consequence analysis
• risk assessment
• zones and conduits
• security levels
• design assumptions
• risk treatment
• Governance, competence, communication, documentation, validation, risk, and follow-up considerations

Instructor Demonstration

The instructor demonstrates the directing threats, vulnerabilities, risk, zones, conduits, and security levels workflow, identifies applicable responsibilities, records checkpoints in industrial risk and architecture register, and contrasts the accepted state with a condition where a security level is selected without consequence analysis.

Hands-On Exercise

Complete a controlled implementation, management, audit, assessment, foundation, introduction, awareness, or transition exercise for Directing Threats, Vulnerabilities, Risk, Zones, Conduits, and Security Levels. Establish scope and criteria, collect or create evidence, examine “a security level is selected without consequence analysis,” reach a supported conclusion, and preserve the result in industrial risk and architecture register.

1. Confirm objectives, scope, roles, criteria, stakeholders, and expected outputs.
2. Perform the planned activities while recording assumptions, evidence, and decisions.
3. Test a normal case, an exception, and a follow-up or improvement condition.
4. Document conclusions, owners, due dates, escalation, and verification requirements.

Scenario Analysis

• Identify the requirement or principle with the strongest influence on directing threats, vulnerabilities, risk, zones, conduits, and security levels.
• Compare two defensible responses and explain their governance, risk, and evidence trade-offs.
• Determine how the industrial risk and architecture register should be approved, retained, reviewed, and updated.

Troubleshooting Guidance

Separate missing evidence from ineffective practice, and distinguish a documentation issue from a control, process, governance, or competence failure. Use industrial risk and architecture register to trace the earliest divergence. Treat “a security level is selected without consequence analysis” as a hypothesis until the response is validated against the applicable requirement and intended outcome.

Validation Checklist

• The scope, criteria, stakeholders, and intended outcome for directing threats, vulnerabilities, risk, zones, conduits, and security levels are explicit.
• The industrial risk and architecture register links statements and decisions to objective, reviewable support.
• Responsibilities, competence, communication, risk, legal duties, and change impact were considered where relevant.
• Findings, corrective actions, monitoring, review triggers, and improvement ownership are clear.

Lesson Outcome

Learners can apply Directing Threats, Vulnerabilities, Risk, Zones, Conduits, and Security Levels, explain the reasoning used, and defend the result through industrial risk and architecture register.