Choose Appropriate Tiers for Risk Governance and Management. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization with a high risk appetite and a rapidly evolving threat landscape is most likely to select which NIST CSF tier?

   • ATier 3: Repeatable
   • BTier 4: Adaptive
   • CTier 1: Partial
   • DTier 2: Risk Informed
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A manufacturing company currently operates at Tier 2 (Risk Informed). They have formal risk assessment processes, but these are applied inconsistently across different business units. The company wants to progress to Tier 3 (Repeatable). What is the most critical step to achieve this progression?

   • AEstablish organization-wide risk management policies and ensure consistent application
   • BInvest in advanced threat intelligence tools
   • CIncrease the frequency of risk assessments to quarterly
   • DOutsource risk management to a third-party provider
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A non-profit organization handles sensitive donor information but has a limited budget and a moderate risk appetite. They have some informal security practices but no formal risk management process. They are considering adopting the NIST CSF. Which tier is the most realistic starting point for their risk governance?

   • ATier 1: Partial
   • BTier 3: Repeatable
   • CTier 4: Adaptive
   • DTier 2: Risk Informed
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial services company is at Tier 3 (Repeatable) and wants to progress to Tier 4 (Adaptive). They have consistent processes and organization-wide integration, but their risk management is largely reactive to incidents. Which capability is most critical to develop to achieve Tier 4?

   • AIncrease the frequency of risk assessments from annual to quarterly
   • BImplement a continuous monitoring program that feeds real-time risk data into decision-making
   • CDevelop more detailed risk documentation for auditors
   • DExpand the risk management team to include more analysts
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A government agency is required by law to protect citizen data and faces persistent cyber threats from nation-state actors. It has a low risk appetite and must demonstrate due diligence to auditors. The agency has formal risk management processes but they are not yet consistently applied across all departments. Which tier should the agency target to meet its obligations?

   • ATier 2: Risk Informed
   • BTier 1: Partial
   • CTier 3: Repeatable
   • DTier 4: Adaptive
   Reveal Solution Discussion Select an answer first