Describe GOVERN Function and Its Relationship with the Enterprise Risk Management (ERM). NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the role of the GOVERN function in establishing cybersecurity policies?

   • ATo monitor and detect security incidents
   • BTo respond to and recover from security incidents
   • CTo implement specific security controls and technologies
   • DTo define and communicate the organization's cybersecurity policies and expectations
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important for the GOVERN function to define clear roles and responsibilities for cybersecurity?

   • ATo avoid any single individual being accountable for cybersecurity decisions
   • BTo ensure that only the IT department is responsible for cybersecurity
   • CTo satisfy external auditors without affecting internal operations
   • DTo ensure that cybersecurity risk is managed consistently and that there is accountability for decisions
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A regional bank is updating its cybersecurity strategy. The board has set a strategic objective to expand digital banking services to new markets while maintaining a conservative risk appetite. The CISO proposes a cybersecurity strategy that prioritizes aggressive adoption of cloud-based services to accelerate innovation. What should the CISO do to ensure the cybersecurity strategy aligns with the organization's mission and risk appetite?

   • AProceed with the aggressive cloud adoption strategy because it supports the digital expansion objective.
   • BPresent the aggressive strategy to the board and let them decide without modification.
   • CDelay all digital expansion until a separate, more conservative strategy is approved.
   • DAdjust the cybersecurity strategy to reflect the board's risk appetite and support the digital expansion while managing risks within acceptable levels.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A retail company's enterprise risk management team uses a 5x5 risk matrix to evaluate risks. The cybersecurity team uses a different scoring system based on CVSS scores. The board has asked for a unified view of risks. What should the cybersecurity team do to align with the GOVERN function?

   • AAsk the enterprise risk team to adopt CVSS scores for all risks.
   • BMap cybersecurity risk scores to the enterprise risk matrix so that risks can be compared consistently.
   • CContinue using CVSS scores and present them separately to the board.
   • DCreate a new scoring system that is a hybrid of CVSS and the enterprise matrix.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A large logistics company has a cybersecurity team that reports to the IT director. The enterprise risk team is separate and reports to the CFO. There is no formal communication between the two teams. The company wants to improve its cybersecurity governance. What should the company do?

   • ACreate a new position that reports to both the IT director and the CFO.
   • BEstablish a formal reporting line from the cybersecurity team to the enterprise risk management function.
   • CKeep the current structure and rely on informal communication between the teams.
   • DMove the cybersecurity team under the CFO to align with the risk team.
   Reveal Solution Discussion Select an answer first