Discover How to Develop and Apply Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A retail company is negotiating a contract with a cloud service provider. The provider asks for evidence of the company's cybersecurity posture. The CISO wants to share information without revealing sensitive internal details. Which use of the CSF Organizational Profile is most appropriate?

   • AShare a high-level summary of the current and target profiles, focusing on outcomes achieved and planned improvements.
   • BRefuse to share any profile information because it is all confidential.
   • CProvide a summary of the target profile only, highlighting the company's future security goals.
   • DShare the full current profile, including all subcategory ratings and internal comments, to demonstrate transparency.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company decides to develop its first CSF Organizational Profile. The cybersecurity team has gathered data on existing controls and interviewed department heads about current practices. According to the CSF profile development process, what should the team do next?

   • AFinalize the current profile from the gathered data, then define the target profile based on business requirements and risk tolerance.
   • BUse the gathered data to create a single profile that merges current and target states into one document.
   • CImmediately create a target profile based on industry best practices and skip the current profile to save time.
   • DWait for an external auditor to define the target profile before documenting the current state.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A regional hospital system is preparing its annual cybersecurity report for the board of directors. The CISO wants to present a clear, non-technical summary of the organization's current cybersecurity posture and the prioritized improvements planned for the next fiscal year. Which use of a CSF Organizational Profile best supports this goal?

   • AReplace the annual report with a detailed technical list of all CSF subcategory ratings for each department.
   • BDevelop both current and target profiles, then present the gap analysis and prioritized actions to the board.
   • CCreate a target profile that reflects the desired future state and share it with the board as the organization's current posture.
   • DUse only the current profile to list all implemented controls, without referencing target outcomes or gaps.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What does a current profile represent?

   • AThe organization's desired cybersecurity outcomes for the future
   • BThe minimum cybersecurity requirements set by regulators
   • CThe cybersecurity posture of a competitor organization
   • DThe organization's current cybersecurity posture (as-is state)
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization is updating its enterprise risk management program. The CISO wants to ensure that cybersecurity investments are aligned with the organization's overall risk appetite. How can the CSF Organizational Profile support this integration?

   • AUse the current and target profiles to identify gaps and then prioritize actions that align with the organization's risk tolerance.
   • BKeep the profiles separate from risk management to avoid complicating the existing process.
   • CReplace the risk management program with the CSF profile to simplify decision-making.
   • DUse the target profile to define the organization's risk appetite and then adjust the risk management program to match.
   Reveal Solution Discussion Select an answer first