Define the Organizational Context and Risk Management Strategy. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best reflects stakeholder expectations in the context of cybersecurity risk management?

   • AStakeholders expect all risks to be transferred to insurance
   • BThe organization's customers expect their data to be protected
   • CStakeholders expect cybersecurity to be invisible and irrelevant
   • DStakeholders expect the organization to share all data publicly
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm has established a risk appetite that allows for 'moderate' risk in new product development but 'low' risk in customer data handling. The firm is about to launch a new mobile app that collects customer financial data. Which action best applies the risk appetite to guide risk management decisions?

   • APerform a risk assessment of the app and compare the identified risks to the established risk tolerance levels for customer data.
   • BDelay the app launch indefinitely until all risks are eliminated.
   • CRequire the app to have the highest possible security controls regardless of cost or impact on usability.
   • DApprove the app launch without a risk assessment because the firm has a moderate risk appetite for new products.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A retail chain is defining its risk management strategy and wants to incorporate supply chain risk management. The chain relies on a single supplier for its point-of-sale (POS) software. Which action best incorporates supply chain risk into the risk management strategy?

   • ARely on the supplier's incident response plan to handle any security issues.
   • BInclude the POS supplier's security posture as a key risk factor in the organization's risk assessment process.
   • CRequire the POS supplier to provide a security certification and consider the risk managed.
   • DExclude supply chain risks from the strategy because the supplier is a third party.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A university's risk management strategy is to 'enable research while protecting sensitive data.' The university is aligning its strategy with the NIST GOVERN function. Which action best demonstrates this alignment?

   • APurchase cyber insurance to cover potential data breaches.
   • BImplement a data loss prevention (DLP) tool to monitor research data transfers.
   • CEstablish a governance structure where research and IT leadership jointly review and approve risk decisions.
   • DConduct a security awareness training for all researchers.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why must an organization identify applicable legal, regulatory, and contractual requirements as part of the GOVERN function?

   • ATo eliminate the need for cybersecurity controls
   • BTo ensure risk management decisions account for compliance obligations
   • CTo satisfy the requirements of the NIST framework only
   • DTo avoid all legal liability by transferring risk to customers
   Reveal Solution Discussion Select an answer first