Explain GOVERN Function Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A newly formed company is establishing its cybersecurity program. The CEO wants to ensure that cybersecurity is not just an IT issue but is considered at the highest levels of the organization. Which action best establishes this governance foundation?

   • AHire a team of security engineers to deploy firewalls and endpoint protection.
   • BEstablish a board-level committee with explicit oversight of cybersecurity strategy and risk.
   • CPurchase cyber insurance to cover potential financial losses from breaches.
   • DCreate a detailed incident response plan and test it regularly.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a new cybersecurity policy requiring all employees to use a password manager. The CISO wants to ensure the policy is effectively communicated and enforced. Which approach is most likely to achieve this?

   • ASend a single email to all employees announcing the new policy.
   • BPublish the policy on the intranet, require employees to acknowledge it, and have managers verify compliance during performance reviews.
   • CAsk the IT help desk to remind employees about the policy when they call for support.
   • DAdd the policy to the employee handbook without any additional communication.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which NIST CSF 2.0 function is primarily responsible for ensuring that cybersecurity risk management is integrated into the organization's overall governance structure?

   • AGOVERN
   • BIDENTIFY
   • CRESPOND
   • DPROTECT
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A multinational corporation operates in a country with strict data residency laws requiring all citizen data to remain within national borders. The company's enterprise risk management (ERM) team is developing a new risk register. How should the cybersecurity team ensure this legal requirement is reflected in the risk management strategy?

   • ATreat the law as a compliance issue only and handle it separately from the risk management strategy.
   • BAssume the law applies only to government agencies and ignore it for the company's operations.
   • CDocument the data residency law as a legal/regulatory constraint that defines the organization's risk tolerance for data storage locations.
   • DTransfer the risk to a cloud provider by signing a contract that holds them liable for any non-compliance.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the context of the NIST CSF 2.0 GOVERN function, what is the primary role of understanding the organization's mission and stakeholder expectations?

   • ATo shape the cybersecurity risk management strategy so that it supports the organization's objectives and priorities
   • BTo determine the specific security controls to implement for each system
   • CTo select the cybersecurity framework that the organization will adopt
   • DTo identify all potential threat actors that could target the organization
   Reveal Solution Discussion Select an answer first