How is the threat landscape and risk assessments tied to this standard? How does it define multiple security zones and conduits to mitigate security risks? And what are the best practices for implementing into industrial control systems and for integrating security controls into existing systems.