56 Handbook of SCADA/Control Systems tna [=] San 1 insted stn Src Figure 4.3 How assets support business functions. be overprotected, which is inefficient, while others may be underprotected, which is inef- fective. One approach involves identifying assets according to the following * Atthe unique or individual asset level, how does the loss of the asset affect the avail- ability of the service (in terms of drops in production, etc) or the integrity of the service (in terms of quality)? * Atthe unique level, what are the confidentiality concerns associated with the unauthor- ized disclosure or loss of control over information that is directly related to the asset? + How would these losses at the unique asset level affect the larger system, commu- nity, regional capability, or corporate entity (SLAs, legal or regulatory contracts, rep- utation, etc)? For example, in further consideration of the valve mixing a chemical into the paint for a piece of metal, one might argue that the loss of the valve entirely could lead to a shutdown of the painting line for a period of 5 h while it was replaced. The cost of this dis- ruption would be, approximately, the cost of replacing the part, any installation/testing/ calibration costs, and the lost production time while employees stood idle and no process- ing is being conducted (in the absence of redundant systems). Some of these costs may be recovered from returning the part for refurbishment or repairing in-house (reducing the costs associated with having to purchase a new part). The loss of the line, however, means that certain items may not be delivered on time, which is a cascading effect of the risk. Again, scope factors significantly here—the focus starts tactically or locally, but quickly rolls up to the level of the company. In this case, one might consider any penalties for late shipment, the potential losses associated with customer cancellation, or the loss of cred- ibility or reputation in terms of the ability to deliver a product. Finally, downstream costs @)@Secure_ICS