Describe GOVERN Function and Its Relationship with the Enterprise Risk Management (ERM). NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the primary purpose of the GOVERN function?

   • ATo identify, analyze, and prioritize cybersecurity risks to the organization
   • BTo respond to and recover from cybersecurity incidents
   • CTo establish and communicate the organization's cybersecurity risk management strategy, expectations, and policy
   • DTo detect and analyze cybersecurity anomalies and events
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government agency's cybersecurity strategy is focused on protecting sensitive citizen data. The agency's mission includes providing accessible online services. The CISO wants to ensure the cybersecurity strategy supports this mission. What should the CISO do?

   • AAlign the cybersecurity strategy with the agency's mission and the need to provide accessible services while protecting data.
   • BPrioritize data protection above all else, even if it limits online service accessibility.
   • CFocus exclusively on compliance with data protection regulations.
   • DAdopt a cybersecurity strategy from another agency to save time.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A financial institution has a cybersecurity policy that is reviewed annually. However, the threat landscape changes rapidly, and the enterprise risk team updates its risk assessments quarterly. The CISO wants to ensure policy oversight is aligned with the risk management process. What should the CISO do?

   • ADelegate policy updates to the enterprise risk team to ensure alignment.
   • BKeep the annual review cycle because it is sufficient for policy updates.
   • CMove to a continuous policy review process that is independent of the risk assessment cycle.
   • DAlign the policy review cycle with the enterprise risk assessment cycle to ensure policies reflect current risks.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the NIST Cybersecurity Framework 2.0, which statement best describes the scope of the GOVERN function?

   • AIt focuses only on external regulatory compliance and reporting requirements
   • BIt is limited to the IT department and focuses solely on technical security controls
   • CIt is primarily concerned with the day-to-day operation of security tools and technologies
   • DIt encompasses the entire organization, including executive leadership, and addresses cybersecurity as an enterprise risk
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the NIST Cybersecurity Framework 2.0, how does the GOVERN function ensure that cybersecurity strategy is aligned with organizational mission and objectives?

   • ABy ensuring that cybersecurity strategy is informed by and supports the organization's mission, objectives, and stakeholder expectations
   • BBy focusing only on technical security requirements without considering business needs
   • CBy requiring that all cybersecurity decisions be made by external consultants
   • DBy developing the cybersecurity strategy independently of the organization's business strategy
   Reveal Solution Discussion Select an answer first