Define Clear Roles and Responsibilities for Cybersecurity Personnel. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   When assigning cybersecurity tasks to individuals or teams, what must accompany the assignment to ensure the work can be completed effectively?

   • AA formal job title change for each person involved
   • BAppropriate authority and accountability
   • CA written contract with each employee
   • DA budget increase for the cybersecurity department
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm updated its incident response plan to name the CISO as the sole decision-maker for declaring a breach. The plan was posted on the internal wiki, but the on-call security analysts were not told about the change. During a suspected breach, an analyst hesitated to escalate because they believed the previous policy (where the IT director decided) was still in effect. What is the most direct cause of this failure?

   • AThe updated roles and responsibilities were not communicated to the analysts who execute them.
   • BThe CISO did not have the authority to make breach declarations.
   • CThe incident response plan was not reviewed annually as required by policy.
   • DThe IT director should have retained decision-making authority to avoid confusion.
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   Why is it important to document roles and responsibilities in official policies or charters?

   • ATo satisfy the requirements of the NIST Cybersecurity Framework for all organizations
   • BTo ensure clarity and consistency in how cybersecurity duties are understood and performed
   • CTo provide a legal defense in case of a security breach
   • DTo allow employees to negotiate their job responsibilities
   Reveal Solution Discussion Select an answer first