Define the Organizational Context and Risk Management Strategy. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to integrate cybersecurity risk management with the organization's mission and objectives?

   • ATo ensure cybersecurity supports the achievement of business goals
   • BTo eliminate the need for stakeholder communication
   • CTo reduce the organization's overall risk to zero
   • DTo make cybersecurity the sole focus of the organization
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A utility company is defining its organizational context. The company operates critical infrastructure and is regulated by NERC CIP. It also has a risk appetite that is 'very low' for any disruption to power generation. Which statement best captures the organizational context for cybersecurity risk management?

   • AThe company's mission to provide reliable power, the NERC CIP regulatory requirements, and the very low risk tolerance for generation disruption.
   • BThe company's risk tolerance for generation disruption and the names of its major competitors.
   • CThe company's list of critical assets, the number of cybersecurity staff, and the current threat intelligence feeds.
   • DThe NERC CIP regulatory requirements and the company's annual cybersecurity budget.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the NIST Cybersecurity Framework 2.0 GOVERN function, which activity best describes defining the organizational context for cybersecurity risk management?

   • AIdentifying internal and external factors that influence the organization's cybersecurity risk
   • BRecovering systems and data after a cybersecurity incident
   • CMonitoring security alerts and responding to incidents in real time
   • DSelecting and implementing security controls to mitigate identified vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software company has a risk appetite that is 'high' for innovation but 'low' for compliance violations. The company is developing a new product that will collect personal data and is subject to GDPR. Which action best applies the risk appetite to guide the product development?

   • AAllow the product to use innovative features but require a GDPR compliance review before launch.
   • BAvoid collecting any personal data to eliminate GDPR risk, even if it reduces product functionality.
   • CLaunch the product quickly to gain market share and address GDPR issues later.
   • DStop all development until the product is fully GDPR compliant, even if it delays launch.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A food processing company has a risk appetite that is 'low' for product safety incidents but 'moderate' for operational disruptions. The company is considering a new supplier for its inventory management system. The supplier's system has had recent security incidents, but it offers significant cost savings. Which action best applies the risk appetite to guide the decision?

   • ARequire the supplier to guarantee zero security incidents in the contract.
   • BReject the supplier immediately because of the recent security incidents, regardless of cost savings.
   • CApprove the supplier because of the cost savings, ignoring the security incidents.
   • DConduct a detailed security assessment of the supplier's system and compare the risks to the company's risk tolerance for operational disruptions.
   Reveal Solution Discussion Select an answer first