Explain GOVERN Function Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A mid-sized manufacturing company has just appointed a new CISO. The CEO asks the CISO to ensure that cybersecurity risks are considered in all major business decisions, from new product lines to acquisitions. The company currently has no formal risk committee. What should the CISO do first to establish this integration?

   • ADraft a comprehensive cybersecurity policy and distribute it to all employees for immediate compliance.
   • BPurchase a new risk management software platform to track all identified risks.
   • CHire additional security analysts to conduct more frequent vulnerability scans.
   • DCreate a cybersecurity risk committee with representation from legal, finance, operations, and IT, reporting to the CEO.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of cybersecurity policies, processes, and procedures within the GOVERN function?

   • ATo document all cybersecurity incidents for external reporting
   • BTo provide a framework for consistent decision-making and behavior regarding cybersecurity
   • CTo replace the need for technical security controls
   • DTo ensure that all employees have the same level of access to systems
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's board receives a cybersecurity dashboard that shows the number of security incidents, patch compliance, and training completion rates. The board is satisfied with these metrics. However, the CISO is concerned that these metrics do not reflect the effectiveness of the cybersecurity strategy. What should the CISO do?

   • ADevelop outcome-based metrics that measure the reduction of cyber risk and the achievement of strategic objectives.
   • BAsk the board to trust the CISO's judgment on strategy effectiveness without metrics.
   • CReplace the dashboard with a narrative report that describes the security posture in detail.
   • DAdd more operational metrics to the dashboard, such as the number of firewalls deployed.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is implementing the NIST CSF 2.0. The CEO asks the CISO to explain the purpose of the GOVERN function. Which statement best describes its purpose?

   • ATo identify and prioritize cybersecurity risks and their potential business impact.
   • BTo respond to cybersecurity incidents and contain their impact.
   • CTo establish the organization's cybersecurity risk management strategy, expectations, and policy, and to integrate it with enterprise risk management.
   • DTo detect cybersecurity events and anomalies in a timely manner.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In the context of the GOVERN function, why is it important to manage cybersecurity risks in the supply chain?

   • ABecause supply chain risks are not part of the organization's risk management
   • BBecause third-party products and services can introduce vulnerabilities into the organization
   • CBecause the organization is not responsible for risks introduced by suppliers
   • DBecause suppliers are always the source of all cybersecurity incidents
   Reveal Solution Discussion Select an answer first