CSP-11 CSP-11 D4.01 · Domain 4 · Emergency Management · 9%
Cyber in ERP
At 02:10, ransomware freezes the HMI/PLC supervisory network on a continuously operated unit. Operators cannot trust displayed levels, alarm communications are degraded, and the emergency coordinator learns that some life-safety support systems may share network or power dependencies. Production proposes holding the last displayed setpoints and bypassing a protective trip to avoid shutdown. You are the CSP: decide when the cyber event becomes a physical emergency, what must be protected first, and how cyber containment can proceed without creating a hazardous process transition.
Updated . Independent CSP-11 practice. Not BCSP-endorsed. No pass guarantee.
Decision rule
Cyber events are emergency scenarios. An ERP that ignores OT/IT will fail the plant.
Safety instrumented functions can be blinded by a network event. Plan isolation and manual safe-state.
In 20 seconds
- Cyber events are emergency scenarios.
- An ERP that ignores OT/IT will fail the plant.
- Cyber impacts physical ERP/ICS when OT and IT failures disrupt response.
- Include cyber scenarios in continuity and emergency planning when credible.
How to apply Cyber in ERP
THEORY: Integrate cyber into ERP: who can declare, how to reach a safe state if HMI lies, how to talk when email is down. CALC: None. FIELD: Ransomware on the historian during a unit upset. ICS roles plus a pre-written manual shutdown path. ASSESS: Calling the IT helpdesk the incident commander for a live process is the trap.
Worked case
Wrong first move: Wait for IT. Correct move: Safe-state first; then cyber response under ICS.
Why the rule holds
Related: 47, 48, 94.
Same rule, different setting
Ransomware locks the well-pad RTU network at 02:10. The coordinator wants to “keep wells on last setpoints,” disable the SIS so shutdown valves stay open, and treat it as an IT ticket — not an ERP activation. Gas detection is on the same domain. You are the CSP. The question is whether cyber is an emergency, and whether production beats fail-safe.
Ransomware locks the tower-crane and site-access controllers at 02:10. The superintendent wants to “keep lifts on last setpoints,” defeat interlocks so the crane stays live, and treat it as an IT ticket — not an ERP activation. Site alarms are on the same domain. You are the CSP. The question is whether cyber is an emergency, and whether production beats fail-safe.
Picture / model
Treat an OT cyber event according to its physical consequences. When loss of trustworthy control, indication, alarms, protective functions, communications, access, or life-safety dependencies creates a credible hazard, emergency management and cyber incident response must operate together. Protect people and the process through validated safe-state actions, coordinate containment with operations, and verify control and safeguards before restart.
Exam traps
Original SafePath contrasts for Cyber in ERP. These are study traps, not recalled BCSP items.
| Trap | Correct read |
|---|---|
| IT ticket only | Wrong if control, safety, utilities, or life-safety are in play — activate ERP |
| Defeat SIS to keep running | HIER invert — fail-safe is the design; bypass is the emergency |
| ERP | Tonight: people, isolation, command, notifications |
| Cyber IR | Contain/eradicate/preserve — supports ERP, does not replace it |
| BCP | Tomorrow’s operations — not the 02:10 decision |
Field move
Field decision: Use the site's emergency decision triggers, account for personnel, assess instrument reliability and move to the validated safe operating....
Scenarios
Scenario 1 · Fundamental · CSP-11 D4.01
A ransomware event disables process control displays and may affect gas detection. Which first response best protects people?
Best action: Use the site's emergency decision triggers, account for personnel, assess instrument reliability and move to the validated safe operating or shutdown state.
Why: Evaluate the best response. A cyber event that can change a physical process is an operations emergency. Do not trust stale displays, bypass an independent trip, or improvise a valve state. A ransomware event disables process control displays and may affect gas detection. Which first response best…
Scenario 2 · Fundamental · CSP-11 D4.01
A nuisance ransomware alert affects only an isolated office printer; OT and life-safety systems are verified unaffected. What response is proportionate?
Best action: Use the cyber incident process and monitor dependencies; escalate emergency response if physical hazards or critical services are affected.
Why: Evaluate the best response. A cyber event that can change a physical process is an operations emergency. Do not trust stale displays, bypass an independent trip, or improvise a valve state. A nuisance ransomware alert affects only an isolated office printer; OT and life-safety systems are verified…
Scenario 3 · Fundamental · CSP-11 D4.01
A control-room display freezes while field gauges disagree. A supervisor suggests relying on the last values for another shift. What is the sound decision?
Best action: Treat stale values as untrusted and use approved alternate instrumentation and safe-state criteria.
Why: Evaluate the best response. A cyber event that can change a physical process is an operations emergency. Do not trust stale displays, bypass an independent trip, or improvise a valve state. A control-room display freezes while field gauges disagree. A supervisor suggests relying on the last values…
If the stem says this
| Stem signal | Best direction |
|---|---|
| ERP assumes always-on cellular during outage | add resilient communications/manual fallbacks |
| OT remote vendor access unrestricted | segment and control access |
| no cyber scenario in drills | exercise cyber-impacted response |
| two answers work | higher hierarchy / system / design |
| single digital path for critical trip | add independence/fallback |
Check before you leave
- ✓ Cyber impacts physical ERP/ICS when OT and IT failures disrupt response.
- ✓ Include cyber scenarios in continuity and emergency planning when credible.
- ✓ Access control, segmentation, and backups are engineered cyber controls.
- ✓ Do not assume phones/radios work if the stem kills infrastructure.
- ✓ Manual fallback procedures need practice.
- ✓ Vendor remote access is a common weak point.
Blueprint mapping
Cyber in ERP is the SafePath study class for CSP-11 D4.01 inside CSP-11 Domain 4, Emergency Management (9%). Emergency Management covers preparedness, response, recovery, fire protection, hazardous-material transportation/security, and workplace violence prevention.
SafePath uses the publicly posted CSP-11 outline as a study map. It does not reproduce official exam content, and it is not affiliated with or endorsed by BCSP or Pearson VUE.
Practice / flashcards / formulas
More classes in Emergency Management
Nearby lessons mapped to the same CSP-11 domain.
CSP-11 D4.01
Other classes on this task
Guides that use Cyber in ERP
- CSP mock exam guideTimed mixed-domain rehearsal, not a BCSP form
- CSP-11 exam prep guideDomain weights, sample items, and a study sequence
- CSP-11 blueprint and weightsSeven published domains and the class map
- Seven-domain study directoryScope, tasks, and links into each lesson
- How to study for the CSP examA 16–24 week independent study plan
Cyber in ERP study questions
- What decision does the Cyber in ERP class train?
- Cyber events are emergency scenarios. An ERP that ignores OT/IT will fail the plant. This is independent SafePath CSP practice for CSP-11 D4.01. It is not an official BCSP item and it is not a pass guarantee.
- What exam trap shows up in Cyber in ERP?
- A common miss treats this as sufficient: IT ticket only The stronger read is: Wrong if control, safety, utilities, or life-safety are in play — activate ERP
- How does Cyber in ERP map to the CSP-11 blueprint?
- SafePath maps this class to CSP-11 D4.01 in Domain 4, Emergency Management (9% of the published blueprint). Use the public outline for study planning. SafePath is not affiliated with or endorsed by BCSP.
Verify
Verify: Confirm current certification requirements with BCSP and technical requirements with the cited authoritative standard.