Describe GOVERN Function and Its Relationship with the Enterprise Risk Management (ERM). NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A technology startup is growing rapidly and has not yet formalized its cybersecurity governance. The CEO wants to ensure that cybersecurity decisions are made in a way that supports business agility while managing risk. The startup has a flat organizational structure and limited resources. What is the most appropriate first step to implement the GOVERN function?

   • AWait until the company grows larger before implementing any governance.
   • BHire a full-time chief information security officer immediately.
   • CDefine a lightweight governance model that assigns clear cybersecurity roles and aligns with the company's risk appetite.
   • DAdopt a comprehensive governance framework from a large enterprise to ensure completeness.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the role of governance structures, roles, and responsibilities in implementing the GOVERN function?

   • AThey provide a framework for decision-making and accountability regarding cybersecurity risk
   • BThey are optional and only needed for large organizations
   • CThey are defined by external regulatory bodies and cannot be customized
   • DThey are primarily focused on technical implementation of security controls
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does the GOVERN function oversee cybersecurity processes and procedures within the ERM framework?

   • ABy delegating all oversight to external security auditors
   • BBy focusing only on technical procedures and ignoring policy
   • CBy ensuring that processes are never changed once they are established
   • DBy conducting regular reviews and updates to ensure they remain effective and aligned with enterprise risk
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the role of stakeholder expectations in the GOVERN function's alignment of cybersecurity strategy?

   • AStakeholder expectations are irrelevant to cybersecurity strategy development
   • BStakeholder expectations are used to define the organization's mission and objectives
   • CStakeholder expectations are a key input that helps shape cybersecurity strategy and priorities
   • DStakeholder expectations are considered only if they align with the cybersecurity team's preferences
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A global manufacturing company is implementing the NIST CSF 2.0. The enterprise risk team uses a quantitative risk model based on financial impact. The cybersecurity team uses a qualitative approach. The board wants to approve a cybersecurity investment that is justified in financial terms. The CISO must present a business case. What is the most effective approach?

   • ADevelop a separate financial model for cybersecurity that is not linked to the enterprise risk model.
   • BPresent the qualitative risk assessment and argue that it is sufficient for decision-making.
   • CAsk the board to accept the qualitative approach because cybersecurity is unique.
   • DTranslate cybersecurity risks into financial terms using the enterprise risk model to support the investment decision.
   Reveal Solution Discussion Select an answer first