Choose Appropriate Tiers for Risk Governance and Management. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A global technology company has achieved Tier 4 (Adaptive) in most business units. However, a newly acquired subsidiary operates at Tier 1 (Partial). The company's risk governance requires a single, consistent tier across the entire organization. What is the most appropriate approach?

   • AKeep the subsidiary at Tier 1 to avoid disrupting its operations
   • BDevelop a phased roadmap to bring the subsidiary to Tier 4 over time
   • CLower the entire company to Tier 2 to match the subsidiary
   • DForce the subsidiary to adopt Tier 4 immediately
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A technology company has a mature security program with consistent, documented processes. They regularly share threat intelligence with industry peers and adjust their controls in near real-time based on emerging threats. However, they have not yet integrated cyber risk metrics into their enterprise risk management dashboard. Which NIST CSF tier best describes this organization?

   • ATier 1: Partial
   • BTier 3: Repeatable
   • CTier 4: Adaptive
   • DTier 2: Risk Informed
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A mid-sized logistics company operates at Tier 2 (Risk Informed). It has formal risk processes, but they are siloed within the IT department and not integrated with enterprise risk management. The company's leadership wants to progress to Tier 3 (Repeatable) without overburdening the small risk team. Which approach best balances the need for progression with resource constraints?

   • AAdopt a zero-trust architecture to reduce overall risk
   • BImplement a fully automated risk management platform
   • CHire additional cybersecurity staff to manage risk processes
   • DEstablish an enterprise risk committee and integrate cyber risk into existing enterprise risk reporting
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of progressing from a lower NIST CSF tier to a higher one?

   • ATo comply with all regulatory requirements automatically
   • BTo enhance risk governance and management capabilities
   • CTo eliminate all cybersecurity risks
   • DTo reduce the cost of cybersecurity tools
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A university is at Tier 2 (Risk Informed) and wants to progress to Tier 3 (Repeatable). They have formal risk processes but they are not consistently applied across departments. The university has a decentralized structure, making it challenging to enforce uniform practices. Which approach is most effective for achieving Tier 3?

   • ADevelop department-specific risk processes tailored to each unit's needs
   • BIncrease cybersecurity awareness training for all staff
   • CEstablish a central risk office with authority to oversee and coordinate risk management across departments
   • DMandate a single risk management framework and require all departments to report compliance
   Reveal Solution Discussion Select an answer first