Define the Organizational Context and Risk Management Strategy. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a legal or regulatory requirement that affects an organization's cybersecurity risk posture?

   • AThe General Data Protection Regulation (GDPR) requirements for protecting personal data
   • BThe CEO's preference for cloud services
   • CThe organization's internal password policy
   • DThe marketing department's branding guidelines
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A defense contractor is defining its organizational context and risk management strategy. The contractor relies on a third-party supplier for critical components used in its products. Which action best incorporates supply chain risk management into the organizational context?

   • ARequire the supplier to sign a non-disclosure agreement and consider the supply chain risk managed.
   • BRely on the supplier's self-assessment of its cybersecurity posture without further validation.
   • CExclude supply chain considerations from the organizational context because the supplier is external.
   • DDocument the supplier's role in the organization's value chain and assess the cybersecurity risks associated with the supplier's products and services.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which outcome is directly supported by aligning risk management strategy with the GOVERN function?

   • AImmediate elimination of all vulnerabilities
   • BConsistent risk decisions across the organization
   • CAutomatic compliance with all regulations
   • DGuaranteed prevention of all cyberattacks
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of aligning the organizational risk management strategy with the NIST Cybersecurity Framework's GOVERN function?

   • ATo transfer all risk to third-party vendors
   • BTo satisfy external auditors without changing internal processes
   • CTo eliminate all cybersecurity risks from the organization
   • DTo ensure consistent and informed risk decisions across the organization
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A hospital system has a risk management strategy that prioritizes patient safety above all, but also must maintain operational efficiency to serve a high volume of patients. The system is aligning its strategy with the NIST GOVERN function. The CISO proposes a new policy that would require all new medical devices to undergo a 6-month security review before deployment. The clinical engineering director objects, saying this will delay critical patient care. Which approach best aligns the risk management strategy with the GOVERN function while addressing the conflict?

   • AEstablish a joint committee of clinical and security stakeholders to review the policy and balance patient safety with operational needs.
   • BImplement the 6-month review policy as proposed, since patient safety is the top priority.
   • CAllow clinical engineering to bypass the security review for any device deemed urgent.
   • DDefer the decision to the IT department to avoid conflict between clinical and security teams.
   Reveal Solution Discussion Select an answer first