A Manufacturing Company's Security Engineer Is Concerned a Remote Actor

Multiple Choice

A manufacturing company's security engineer is concerned a remote actor may be able to access the ICS that is used to monitor the factory lines. The security engineer recently proposed some techniques to reduce the attack surface of the ICS to the Chief Information Security Officer (CISO) . Which of the following would BEST track the reductions to show the CISO the engineer's plan is successful during each phase?

A) Conducting tabletop exercises to evaluate system risk
B) Contracting a third-party auditor after the project is finished
C) Performing pre- and post-implementation penetration tests
D) Running frequent vulnerability scans during the project