Define the Organizational Context and Risk Management Strategy. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A government agency has a risk management strategy that prioritizes national security and has a 'very low' risk tolerance for supply chain compromise. The agency is considering a new software vendor that offers a highly capable product but has a significant portion of its development team located in a foreign country. Which action best aligns the risk management strategy with the organizational context?

   • AApprove the vendor because the product is highly capable and the agency has a 'very low' risk tolerance for supply chain compromise.
   • BConduct a thorough supply chain risk assessment of the vendor, including the foreign development team's security practices, before making a decision.
   • CReject the vendor immediately because of the foreign development team, without further assessment.
   • DRequire the vendor to move all development to the agency's country, regardless of cost or feasibility.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to communicate risk appetite and tolerance levels throughout the organization?

   • ATo transfer all risk to senior management
   • BTo ensure all employees make risk decisions consistent with organizational goals
   • CTo eliminate the need for risk assessments
   • DTo hide risk information from external stakeholders
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A media company's risk management strategy is to 'maximize audience growth while protecting user privacy.' The company is aligning its strategy with the NIST GOVERN function. The marketing team wants to launch a new data analytics initiative that would collect extensive user data, but the privacy team is concerned about the risk of data misuse. Which action best aligns the risk management strategy with the GOVERN function?

   • AReject the initiative because of the privacy risks, regardless of audience growth potential.
   • BLet the marketing team decide on the initiative without involving privacy or security.
   • CEstablish a cross-functional review board that includes marketing, privacy, and security to evaluate the initiative against the company's risk appetite.
   • DApprove the initiative because audience growth is the top priority.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A multinational corporation is updating its organizational context. The corporation processes employee data in multiple countries and is subject to various data protection regulations. Which action best identifies the legal and regulatory requirements that affect the corporation's cybersecurity risk posture?

   • ARely on the IT department's knowledge of security best practices to infer legal requirements.
   • BUse a single global privacy policy that meets the strictest regulation and assume compliance everywhere.
   • CEngage legal counsel to review all applicable data protection laws and map them to the corporation's data processing activities.
   • DOnly consider the regulations of the countries where the corporation has offices.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing company has a risk management strategy that prioritizes avoiding any downtime in production systems, even if it means higher security costs. The company is adopting the NIST Cybersecurity Framework's GOVERN function. Which action best aligns the risk management strategy with the GOVERN function?

   • AConduct a penetration test on production systems to identify vulnerabilities.
   • BImplement a new SIEM tool to monitor production systems for security incidents.
   • CDocument the risk appetite as 'very low tolerance for production downtime' and use it as the basis for all risk decisions.
   • DPurchase additional cyber insurance to cover potential production downtime losses.
   Reveal Solution Discussion Select an answer first