Apply the NIST CSF Tiers in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A consulting firm has a low risk appetite and handles sensitive client data. They have a consistent risk management process (Tier 3) and are considering whether to invest in real-time threat intelligence to move to Tier 4. What is the most important consideration?

   • AThe potential reduction in risk from real-time adaptation versus the cost of implementation
   • BThe need to keep up with competitors who are at Tier 4
   • CThe fact that Tier 4 is always the best choice for any organization
   • DThe preference of the IT department for new technology
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A manufacturing company currently operates at Tier 2. They have a risk management program but it is not consistently applied across all plants. The CISO wants to progress to Tier 3 within 18 months. Which initiative would most directly support this progression?

   • AImplement an enterprise-wide risk management policy with mandatory training and audits for all plants
   • BHire a third-party auditor to conduct a one-time risk assessment
   • CPurchase a new threat intelligence platform to improve real-time threat detection
   • DIncrease the cybersecurity budget by 20% to fund additional security tools
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A mid-sized logistics company is deciding which NIST CSF tier to target. They have a moderate risk appetite and a limited security budget. They want to ensure their risk management practices are consistent but do not need real-time adaptation. Which tier should they target?

   • ATier 2: Risk Informed
   • BTier 4: Adaptive
   • CTier 3: Repeatable
   • DTier 1: Partial
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   An organization has established formal cybersecurity risk management practices. These practices are consistently applied across the organization and are based on risk priorities, but the organization does not yet continuously improve or adapt based on lessons learned. Which NIST CSF tier best describes this organization?

   • ATier 1: Partial
   • BTier 2: Risk Informed
   • CTier 3: Repeatable
   • DTier 4: Adaptive
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A retail company is currently at Tier 1. They want to progress to Tier 2 within the next year. What should be their first priority?

   • AInvest in advanced threat intelligence and real-time monitoring tools
   • BWait for a major security incident to justify the need for better practices
   • CConduct a one-time risk assessment and then move on
   • DEstablish a formal risk management process with management approval and communicate it across the organization
   Reveal Solution Discussion Select an answer first