Describe GOVERN Function and Its Relationship with the Enterprise Risk Management (ERM). NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A multinational corporation has a decentralized governance structure. Each business unit has its own cybersecurity team and risk appetite. The enterprise risk team wants to implement a consistent cybersecurity governance framework across the organization. The business units resist because they have different regulatory requirements. What is the best approach?

   • AEstablish a federated governance model that sets enterprise-wide minimum standards while allowing business units to adapt to local regulations.
   • BImpose a single, uniform governance framework across all business units.
   • CCreate a separate governance framework for each business unit and do not attempt to integrate them.
   • DAllow each business unit to maintain its own governance framework without enterprise oversight.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial services firm is developing its annual enterprise risk assessment. The enterprise risk team focuses on credit, market, and operational risks but does not include cybersecurity risk. The CISO wants to ensure cybersecurity risk is considered as part of the overall enterprise risk. What should the CISO do?

   • AFocus only on regulatory compliance for cybersecurity risk.
   • BWork with the enterprise risk team to include cybersecurity risk in the annual risk assessment process.
   • CAsk the enterprise risk team to adopt the cybersecurity risk assessment methodology.
   • DConduct a separate cybersecurity risk assessment and present it to the board.
   Reveal Solution Discussion Select an answer first