Problem: Standards and Regulations There are multiple regulations and standards for Industrial Control Systems. Why is this? Should they be combined into one? Why or why not? Many bulk electric utilities didn't feel they needed to comply with early versions of the NERC CIP. Basically, they didn't think they had critical cyber assets. Provide arguments on why all electric utilities need to comply with the NERC CIP. What are compensating controls? How can they be used to prove compliance? What's the downside to them? What does the Common Criteria provide? How does it benefit the international community? How would you recommend enforcing ICS security regulations and standards? Should this be done by the government or a private organization?