Most people who move from the ISA/IEC 62443 Fundamentals Specialist exam to the Risk Assessment Specialist path discover the same thing: knowing the terms is no longer enough.
Fundamentals asks what a Security Level or a conduit is. Risk assessment asks something harder: given this plant, this evidence and this consequence, what would you decide, and what would you check first?
ISA describes IC33 as the second course in its 62443 certificate program. Its learning objectives read like an assessor's job description: define the scope, gather the data, interpret PHA results, evaluate threat scenarios, establish zones and conduits, and write a Cybersecurity Requirements Specification (CRS).
Below are three classic mistakes the 62443-3-2 workflow is designed to catch. Each comes with a scenario. Try answering before you read the explanation.
A 60-second refresher: the 62443-3-2 workflow
IEC 62443-3-2 is commonly taught as seven steps, ZCR 1 to ZCR 7:
| Step | What it decides |
|---|---|
| ZCR 1 | What exactly is the system under consideration (SUC)? |
| ZCR 2 | What is the worst credible unmitigated consequence? |
| ZCR 3 | How should assets be grouped into zones, and how do they communicate (conduits)? |
| ZCR 4 | Is the initial risk above tolerable risk, so that a detailed assessment is needed? |
| ZCR 5 | Detailed risk assessment, ending in a target Security Level (SL-T) per zone and conduit |
| ZCR 6 | Documenting cybersecurity requirements, assumptions and constraints (the CRS) |
| ZCR 7 | Asset-owner approval |
Most exam traps and real-world errors come from doing a step out of order, or doing it from the wrong evidence.
Mistake 1: Setting the SL-T from the first scenario someone wrote down
Scenario. A team proposes SL-T 2 for a conduit. The only documented scenario is unauthorized viewing of process data. The same conduit also carries remote dosing commands. What should the assessor do?
- A) Keep SL-T 2, because dosing commands are issued only by authenticated operators
- B) Keep SL-T 2 and add an MFA requirement for command users to the CRS
- C) Assess the command-write exposure before confirming the SL-T
- D) Set every zone to SL-T 3 without re-opening the assessment
Best answer: C.
The conduit can write to a dosing process, and that capability has a process consequence a confidentiality scenario never captures. Until that scenario is assessed, any SL-T is set from incomplete evidence.
The distractors are instructive because each is something a real team would say:
- A treats authentication as a reason to skip a scenario. Authentication is a countermeasure to evaluate in the detailed assessment, not a substitute for it.
- B jumps to a control. MFA may well end up in the CRS, but adding it now fixes the answer before the risk is understood.
- D swaps analysis for a bigger number. Raising everything to SL-T 3 costs money and still doesn't tell you whether the command path is adequately protected.
Takeaway: an SL-T must reflect every material capability of the zone or conduit. If a conduit carries commands, the command-write scenario is part of the assessment, not an optional extra.
Mistake 2: Accepting a conduit into the safety zone on paper
Scenario. A safety PLC sends read-only status to an operator display through an engineered gateway. Which evidence best supports accepting this interface as a controlled conduit into the SIS zone?
- A) The safety PLC's IEC 61508 SIL 3 certificate
- B) An approved architecture drawing marking the gateway as read-only
- C) A flow specification plus a tested write-denial at the SIS interface
- D) The gateway's IEC 62443-4-2 SL-C 2 component certificate
Best answer: C.
Each wrong option is real evidence, just evidence of the wrong thing:
- A SIL certificate addresses random and systematic failures in safety functions. It says nothing about whether someone can write into the SIS through the gateway.
- A drawing records design intent. Plants drift; the installed configuration is what matters.
- An SL-C certificate shows what the gateway can support, not how this installation is configured.
Only a specified set of permitted flows, plus a site test showing that writes are denied, describes the system that is actually running.
Takeaway: for a conduit into a safety zone, accept specified flows and tested behaviour, not certificates or diagrams.
Mistake 3: Writing threat scenarios that understate reach
Scenario. An engineering account with configuration privileges on devices at multiple substations hasn't been used for six months. Which threat scenario should the assessment record?
- A) Credential stuffing against the corporate email portal could expose the engineer's mailbox
- B) Account lockout after failed logins could delay an urgent relay-setting change
- C) Compromise of the dormant account could allow an unauthorized change at one substation
- D) Compromise or misuse of the dormant privileged account could permit unauthorized configuration changes across multiple substations
Best answer: D.
C is the tempting one. It is correct in kind but wrong in scale. The account reaches several sites, and that multi-site reach is what drives the consequence. A scenario that names one substation will produce a lower risk score than the situation deserves.
Takeaway: a usable threat scenario names three things: the entitlement or path, the action it enables, and the full reach of the effect. Dormant privileged accounts are a classic route because nobody notices when they are used.
A quick self-check before you sit IC33
If you can answer "yes" to all five, you're thinking like an assessor rather than memorizing definitions:
- Can I explain why the initial assessment starts from unmitigated consequence?
- Can I name what evidence would change an SL-T, and what evidence would not?
- Do I know the difference between SL-T, SL-C and SL-A, and which one a certificate proves?
- Can I turn a risk into a CRS clause that has a pass/fail test?
- Can I tell when a "read-only" claim needs a traffic capture rather than a drawing?
Want more practice like this?
I built an independent practice kit around exactly this style of question:
- 254 scenario questions across two mock exams, case-based practice and a technique drill
- every option explained, including why each wrong answer fails, the key concept, and the IC33 learning objective it maps to
- a 16-page study guide, four worked risk-to-CRS cases, and an Excel tracker that scores you by domain and objective
Launch offer: code **IC33LAUNCH* takes 20% off either edition until 15 November 2026.*
Basic ($29): PDFs, Excel tracker and CSV question bank → https://techsavant013.gumroad.com/l/ic33-risk-assessment-practice-kit
PRO ($49): adds an offline practice app with timed exams and instant feedback, a ready-made Anki deck, a full ZCR 1–7 capstone case and six practitioner templates → https://techsavant013.gumroad.com/l/ic33-risk-assessment-practice-kit-pro
Still at the Fundamentals stage? Start with the CFS practice exams (244 questions) → https://techsavant013.gumroad.com/l/iec62443-fundamentals-practice-exams
Independent study material. Not affiliated with, endorsed by or produced by ISA or IEC. Contains no official or recalled exam questions. All scenarios are fictional.
Top comments (0)