A government organization operates and maintains several ICS environments. The categorization of one of the ICS environments led to a moderate baseline.
The organization has compiled a set of applicable security controls based on this categorization.
Given that this is a unique environment, which of the following should the organization do NEXT to determine if other security controls should be considered?
A. Check for any relevant or required overlays.
B. Review enhancements within the current control set.
C. Modify to a high-baseline set of controls.
D. Perform continuous monitoring.
Correct Answer: C