Explain IDENTITY Function with Its Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization is updating its cybersecurity program. The legal department has identified new state privacy regulations that the organization must comply with. The CISO wants to ensure that these regulatory requirements are incorporated into the organization's cybersecurity policies and that the policies are aligned with the organization's overall business objectives. Which IDENTIFY category and subcategory best addresses this need?

   • AAsset Management (ID.AM) — inventorying data assets
   • BRisk Management Strategy (ID.RM) — establishing risk tolerance
   • CGovernance (ID.GV) — understanding legal and regulatory requirements
   • DRisk Assessment (ID.RA) — identifying compliance risks
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In the Supply Chain Risk Management (ID.SC) category of the NIST Cybersecurity Framework 2.0, which subcategory focuses on establishing requirements for suppliers?

   • AID.SC-02: Suppliers and third-party partners are identified, prioritized, and assessed
   • BID.SC-04: Suppliers and third-party partners are routinely assessed
   • CID.SC-01: Cyber supply chain risk management processes are identified, established, and managed
   • DID.SC-03: Contracts with suppliers and third-party partners are used to implement appropriate measures
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An organization is applying the IDENTIFY function. They review their existing cybersecurity policies, ensure they meet legal requirements, and align their risk management approach with their business strategy. Which IDENTIFY category are they primarily addressing?

   • AGovernance
   • BAsset Management
   • CRisk Assessment
   • DImprovement
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How do the subcategories within the IDENTIFY function contribute to the overall function?

   • AThey provide a set of detailed outcomes that, when achieved together, help the organization understand and manage its cybersecurity risk
   • BEach subcategory operates independently and has no impact on other subcategories
   • CThey are mandatory requirements that all organizations must implement identically
   • DThey are only used for compliance reporting and have no operational value
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A manufacturing company is adopting NIST CSF 2.0. The board of directors has approved a new cybersecurity policy that mandates quarterly reviews of security controls and requires all business units to align their operational plans with the company's risk management objectives. The CISO is now tasked with ensuring this policy is communicated and enforced across the organization. Which IDENTIFY category is the primary focus of this effort?

   • AImprovement (ID.IM)
   • BRisk Assessment (ID.RA)
   • CAsset Management (ID.AM)
   • DGovernance (ID.GV)
   Reveal Solution Discussion Select an answer first