Describe GOVERN Function and Its Relationship with the Enterprise Risk Management (ERM). NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What does the GOVERN function require to ensure cybersecurity risk is integrated into enterprise risk management?

   • AThat cybersecurity risk be managed in isolation from other business risks to avoid conflicts
   • BThat the organization's risk management strategy explicitly includes cybersecurity risk
   • CThat all cybersecurity risk be accepted by the organization without further analysis
   • DThat cybersecurity risk be transferred to an external third party for management
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A hospital system is updating its cybersecurity strategy. The board has set a strategic goal to expand telemedicine services. However, the hospital's risk appetite is very low due to patient safety concerns. The CISO proposes a strategy that includes aggressive adoption of cloud-based telemedicine platforms. The board is concerned about data privacy and patient safety. What should the CISO do?

   • AAbandon the telemedicine expansion to avoid any cybersecurity risk.
   • BPresent the aggressive strategy to the board and let them decide without modification.
   • CDevelop a strategy that supports telemedicine expansion while incorporating additional safeguards to meet the low risk appetite.
   • DProceed with the aggressive cloud adoption because it is necessary for telemedicine expansion.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is developing its enterprise risk management strategy. The board wants to include cybersecurity risk but is concerned about the complexity of integrating it with existing risk categories. The CISO proposes a separate cybersecurity risk framework that is not integrated with ERM. The board rejects this. What is the most likely reason for the rejection?

   • AThe board wants a more complex cybersecurity risk framework than the one proposed.
   • BThe board prefers to outsource cybersecurity risk management to a third party.
   • CThe board does not believe cybersecurity risk is important enough to warrant a separate framework.
   • DThe board expects cybersecurity risk to be managed as part of the overall enterprise risk, not as a separate silo.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization has a cybersecurity policy that is reviewed only when a major incident occurs. The policy is not aligned with the organization's risk management process, and employees are often unaware of their responsibilities. The CISO wants to improve policy oversight as part of the GOVERN function. What should the CISO do?

   • ACreate a one-time comprehensive policy document and distribute it to all employees.
   • BEstablish a regular policy review cycle and link policy updates to the enterprise risk management process.
   • CWait for the next major incident to trigger a policy review.
   • DDelegate all policy updates to the legal department to ensure compliance.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the NIST Cybersecurity Framework 2.0, how does the GOVERN function establish cybersecurity risk management as a part of overall enterprise risk management?

   • ABy delegating all cybersecurity risk management to external security vendors
   • BBy mandating that all cybersecurity risks be eliminated to achieve zero risk
   • CBy ensuring that cybersecurity risk is included in the organization's overall risk management strategy and decision-making processes
   • DBy requiring that cybersecurity risk be treated as a separate and distinct risk category with its own independent management process
   Reveal Solution Discussion Select an answer first