Describe the NIST CSF 2.0 Components. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational corporation is implementing NIST CSF 2.0. The CISO wants to use profiles to communicate cybersecurity posture to the board, but the board is concerned that a single profile may not reflect the different risk tolerances of the company's various business units. Which approach best addresses this concern?

   • ACreate a single enterprise-wide Target Profile that uses the highest risk tolerance across all business units
   • BUse only Implementation Tiers to communicate posture, as they are more granular than profiles
   • CDevelop a single Target Profile based on the most critical business unit's risk tolerance
   • DCreate separate Current and Target Profiles for each business unit, then aggregate them for board reporting
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the NIST CSF 2.0, what is the role of categories within each function?

   • AThey define the specific controls that must be implemented.
   • BThey group related cybersecurity outcomes into logical areas.
   • CThey provide a list of mandatory compliance requirements.
   • DThey assign responsibility to specific organizational roles.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is using NIST CSF 2.0 to improve its cybersecurity posture. The CISO wants to compare the company's current practices against a desired state that reflects industry best practices. Which combination of CSF 2.0 components should the CISO use?

   • AGovern function and Identify function
   • BImplementation Tiers and Functions
   • CCurrent Profile and Target Profile
   • DCategories and Subcategories
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is migrating from NIST CSF 1.1 to 2.0. The CISO is concerned that the new Govern function might overlap with the existing Identify function, causing confusion among the security team. Which statement best clarifies the relationship between Govern and Identify?

   • AGovern replaces Identify, so all risk assessment activities should move to Govern
   • BGovern provides the overarching governance and strategy, while Identify focuses on understanding and managing specific risks
   • CGovern and Identify are identical, so the team can choose either one
   • DIdentify is a subcategory of Govern, so all Identify outcomes are now part of Govern
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A company is implementing NIST CSF 2.0 and has assigned a team to manage the framework. The team is unsure whether they should focus on the six functions or the categories and subcategories. Which statement best describes the relationship between these components?

   • ASubcategories are the highest level, and functions and categories are subordinate to them
   • BFunctions are the highest level, and categories and subcategories provide specific outcomes within each function
   • CFunctions, categories, and subcategories are independent and unrelated
   • DCategories are the highest level, and functions and subcategories are subordinate to them
   Reveal Solution Discussion Select an answer first