Describe GOVERN Function and Its Relationship with the Enterprise Risk Management (ERM). NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A multinational company's board of directors has asked the CISO to present a cybersecurity risk dashboard at the next quarterly meeting. The board wants to see how cyber risks compare with other enterprise risks, such as market and operational risks, to make informed investment decisions. The CISO currently tracks cyber risks in a separate register that is not shared with the enterprise risk team. What should the CISO do first to align with the GOVERN function?

   • ACreate a separate cyber risk dashboard with its own metrics and present it to the board for approval.
   • BOutsource the risk assessment to an external consultant to ensure objectivity.
   • CAsk the enterprise risk team to adopt the cybersecurity risk register format for all risks.
   • DIntegrate cyber risk data into the enterprise risk register and use a common risk language and scoring scale.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does the GOVERN function in the NIST Cybersecurity Framework 2.0 integrate with Enterprise Risk Management (ERM)?

   • AIt ensures that cybersecurity risk is considered alongside other enterprise risks in the organization's overall risk management activities
   • BIt delegates all cybersecurity risk decisions to external auditors and regulators
   • CIt replaces the ERM process with a separate cybersecurity-specific risk management process
   • DIt treats cybersecurity risk as a separate and isolated risk category that is managed independently from other enterprise risks
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A mid-sized manufacturing company has no formal cybersecurity governance structure. The IT manager makes all security decisions, but business units are not consulted, and there is no clear escalation path for risk decisions. The company wants to implement the GOVERN function. What should the company do first?

   • APurchase a cybersecurity risk management software tool to automate risk tracking.
   • BDevelop a detailed incident response plan before any other governance activity.
   • CEstablish a cybersecurity governance committee with representatives from IT, legal, operations, and executive leadership.
   • DAssign the IT manager as the single point of accountability for all cybersecurity decisions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A university has a cybersecurity policy that is not enforced consistently across departments. Some departments have strict controls, while others have none. The university wants to ensure policy oversight is part of its governance. What should the university do?

   • AAllow each department to manage its own policy enforcement to maintain autonomy.
   • BProvide additional training to all employees on the policy.
   • CRevise the policy to be less strict so that all departments can comply easily.
   • DEstablish a central governance body to oversee policy implementation and enforce compliance across all departments.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A non-profit organization has a very limited budget for cybersecurity. The board wants to implement the GOVERN function but cannot afford a full-time CISO or a dedicated governance team. The organization has a small staff and relies on volunteers. What is the most practical approach to implement GOVERN?

   • AOutsource all governance activities to a managed security service provider.
   • BDelay implementation of GOVERN until the organization can afford a full-time CISO.
   • CAdopt a comprehensive governance framework from a large enterprise to ensure completeness.
   • DAssign cybersecurity governance responsibilities to a small committee of staff and volunteers, and align with the organization's risk appetite.
   Reveal Solution Discussion Select an answer first