Explore Different Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A regional hospital chain is building its first NIST CSF 2.0 Organizational Profile. The CISO wants the profile to reflect the current state of the organization's cybersecurity posture so the board can see where the organization stands today before any improvement projects are funded. The security team has completed interviews and gathered evidence from all departments. Which action should the team take to satisfy the CISO's request?

   • ADefine the desired future state for each Subcategory based on industry benchmarks and the organization's risk appetite.
   • BRecord the current practices and outcomes for each Function, Category, and Subcategory, noting implementation tiers and partial controls.
   • CCompare the organization's practices against a peer hospital's published profile and record the differences.
   • DList only the Subcategories where the organization has no controls at all, to highlight the most urgent gaps.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which approach is most effective when communicating profile results to senior management?

   • AUsing business-relevant language and highlighting risk implications
   • BAvoiding discussion of gaps to prevent concern
   • CPresenting raw data without interpretation
   • DFocusing on technical details of each control
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government agency has completed its Organizational Profile and gap analysis. The agency's leadership is preparing a budget request for the next fiscal year. The profile shows significant gaps in the 'Recover' Function, specifically in incident recovery planning (RC.RP) and communications (RC.CO). How should the agency use the profile to support its budget request?

   • AUse the gap analysis to justify funding for specific improvements in RC.RP and RC.CO, linking each request to the associated risk reduction.
   • BRequest funding for all gaps in the profile to achieve full implementation of the Target Profile in one year.
   • CPresent the full profile to the budget committee and let them decide which gaps to fund.
   • DFocus the budget request on the 'Govern' Function, since governance improvements will indirectly address all other gaps.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A manufacturing firm has completed its Current and Target Profiles. The gap analysis shows that the firm is at 'Partial' for most Subcategories, but the Target Profile requires 'Risk Informed' or higher. The firm's leadership is divided: the operations VP wants to prioritize gaps that affect production uptime, while the CFO wants to prioritize gaps that reduce the risk of regulatory fines. The CISO must reconcile these competing priorities. What is the most effective approach?

   • AAsk the leadership team to vote on which priority is more important before proceeding.
   • BPrioritize the gaps that affect production uptime, since operations are the firm's primary business function.
   • CUse the profile to identify gaps that address both production uptime and regulatory risk, and propose a prioritized plan that balances both concerns.
   • DPrioritize the gaps that reduce regulatory fines, since non-compliance can have severe financial consequences.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A utility company is developing its Organizational Profile. The project team has gathered data from various departments, but the team lead is concerned that the data may be inconsistent because different departments interpreted the Subcategories differently. What is the most effective way to ensure consistency in the profile development process?

   • ALet each department submit its own assessment and then average the results to create the profile.
   • BUse a common set of definitions and evidence requirements for each Subcategory, and hold a workshop to align interpretations before finalizing the profile.
   • CUse the NIST CSF 2.0 default profile as the basis and adjust it only where departments disagree.
   • DHave the IT security team alone create the profile, since they are the most knowledgeable about cybersecurity.
   Reveal Solution Discussion Select an answer first