Choose Appropriate Tiers for Risk Governance and Management. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a defining characteristic of Tier 4 (Adaptive) in the NIST CSF?

   • ARisk management is organization-wide and consistently applied
   • BRisk management practices are formal but not consistent
   • CRisk management is performed on an ad-hoc basis
   • DRisk management is continuously improved and adapts to changing threats
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which factor most directly influences an organization's selection of a NIST CSF tier for risk governance?

   • AThe organization's risk appetite and tolerance for uncertainty
   • BThe age of the organization's IT infrastructure
   • CThe number of employees in the organization
   • DThe geographic location of the organization's headquarters
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which NIST CSF tier is characterized by an organization that has formal risk management practices but does not yet have a consistent, organization-wide approach?

   • ATier 3: Repeatable
   • BTier 4: Adaptive
   • CTier 1: Partial
   • DTier 2: Risk Informed
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A healthcare organization is at Tier 1 (Partial) and wants to progress to Tier 2 (Risk Informed) within a year. They have limited resources and must prioritize improvements. Which sequence of actions best supports this progression?

   • AImmediately implement enterprise-wide risk reporting and integrate with all business units
   • BInvest in advanced security analytics tools first, then train staff
   • CConduct a comprehensive risk assessment, then develop formal risk management policies, and obtain management approval
   • DOutsource all risk management to a third-party provider
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A utility company operates critical infrastructure and faces a high threat landscape. They have mature, consistently applied risk management processes and actively participate in sector-specific information sharing. However, their risk management practices are not yet fully integrated with their enterprise risk management function. Which tier best describes this organization?

   • ATier 3: Repeatable
   • BTier 1: Partial
   • CTier 4: Adaptive
   • DTier 2: Risk Informed
   Reveal Solution Discussion Select an answer first