Define the Organizational Context and Risk Management Strategy. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare provider is integrating cybersecurity risk management with its mission to provide 'accessible and affordable patient care.' The provider is considering a new telehealth platform that will store patient data in the cloud. Which approach best integrates cybersecurity risk management with the organization's mission and objectives?

   • AChoose the lowest-cost cloud provider to keep patient care affordable, regardless of security features.
   • BConduct a risk assessment that evaluates how the telehealth platform's security controls affect patient data confidentiality and the mission's accessibility goals.
   • CDefer all cybersecurity decisions to the IT department without involving mission stakeholders.
   • DImplement the platform immediately and address security issues after launch to speed up patient access.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A city government's mission is to 'provide transparent and accessible public services.' The city is implementing a new online portal for citizens to access their personal data. The city's risk appetite is 'low' for data breaches but 'moderate' for service availability. The IT department proposes a 24/7 monitoring solution that would require a significant budget increase, but the city council is concerned about the cost. Which action best integrates cybersecurity risk management with the city's mission and risk appetite?

   • AImplement the 24/7 monitoring solution because the low risk appetite for data breaches justifies the cost.
   • BReject the 24/7 monitoring solution because the city has a moderate risk appetite for service availability.
   • CDelay the portal launch until the full 24/7 monitoring solution can be funded.
   • DImplement a less expensive monitoring solution that provides adequate protection for the portal's data, and communicate the trade-off to the council.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A non-profit organization's mission is to 'provide free legal aid to underserved communities.' The organization is defining its organizational context for cybersecurity risk management. Which factor is most important to include in the context definition?

   • AThe organization's office locations and the age of its computers.
   • BThe organization's mission and the need to protect client confidentiality.
   • CThe organization's social media presence and public reputation.
   • DThe organization's annual budget and the number of volunteers.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is supply chain risk management considered part of the organizational context?

   • ABecause supply chain risks are always the most critical risks
   • BBecause supply chain risks are not relevant to cybersecurity
   • CBecause third-party vendors and suppliers introduce risks that affect the organization
   • DBecause supply chain risks are internal to the organization
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A global e-commerce company is defining its organizational context for cybersecurity risk management. The company processes customer data from the EU, the US, and Asia, and is subject to GDPR, CCPA, and various data residency laws. Which action best identifies the legal and regulatory requirements that affect the company's risk posture?

   • ARely on the legal department's general knowledge of data protection laws without documenting them.
   • BOnly consider the laws of the country where the company's headquarters is located.
   • CCreate a compliance register that lists all applicable laws and regulations and maps them to the company's data flows and processing activities.
   • DImplement a single set of security controls that satisfies the strictest law and ignore the rest.
   Reveal Solution Discussion Select an answer first