Discover How to Develop and Apply Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   How does an Organizational Profile facilitate communication with external stakeholders?

   • ABy sharing detailed network diagrams with partners
   • BBy providing a common language to describe cybersecurity outcomes
   • CBy publishing all internal security policies publicly
   • DBy providing a list of all security vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A global company is preparing to communicate its cybersecurity posture to two different audiences: the board of directors and a potential business partner. The board needs a high-level overview, while the partner needs more detail to assess risk. What is the best approach?

   • ARefuse to share any profile information with the partner because it is confidential.
   • BShare only the target profile with both audiences to avoid revealing current weaknesses.
   • CSend the same detailed report to both audiences to ensure consistency.
   • DCreate two versions of the profile communication: a high-level summary for the board and a more detailed version for the partner.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A utility company has developed current and target profiles. The gap analysis reveals that the 'Protect' function has gaps in access control and data security, while the 'Recover' function is fully implemented. The company's risk assessment shows that a data breach would have a high impact on public safety. What should the company prioritize?

   • APrioritize the 'Protect' gaps related to data security because they align with the highest risk to public safety.
   • BPrioritize the 'Recover' function to maintain its full implementation, even though it has no gaps.
   • CDelay any action until the target profile is updated to reflect the current state.
   • DAddress all 'Protect' gaps equally, regardless of their link to public safety.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial services firm has completed its current and target CSF Organizational Profiles. The current profile shows that the 'Protect' function is largely implemented, but the 'Detect' function has several subcategories rated 'Partially'. The target profile requires full implementation of all 'Detect' subcategories. What is the most appropriate use of these profiles?

   • AUse the gap between the profiles to prioritize investments in the 'Detect' function subcategories that are partially implemented.
   • BDiscard the current profile because it is outdated and rely solely on the target profile for planning.
   • CShare only the target profile with the board to avoid highlighting weaknesses in the 'Detect' function.
   • DTreat the current profile as the target and focus all efforts on maintaining the 'Protect' function.
   Reveal Solution Discussion Select an answer first