Explore Different Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm has completed both its Current and Target Organizational Profiles. The gap analysis shows that the largest gaps are in the 'Protect' Function (specifically PR.PS-01 and PR.AT-01), while smaller gaps exist in 'Recover' and 'Respond'. The firm has a limited budget and must address the most critical risks first. What should the firm do next?

   • AFocus on the smallest gaps first to achieve quick wins and build momentum for the program.
   • BPrioritize improvements in the Protect Function Subcategories with the largest gaps, since they represent the greatest difference between current and target states.
   • CAllocate the budget equally across all Functions to ensure balanced improvement across the entire profile.
   • DRecreate the Target Profile to match the Current Profile so that the gaps disappear and no investment is needed.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A logistics company is developing its first Organizational Profile. The security team has completed a Current Profile that shows strong implementation of most Subcategories, but the company's risk appetite is low and the board has mandated a 'highly mature' security program. The team is now deciding what the Target Profile should reflect. What should the Target Profile be based on?

   • AThe NIST CSF 2.0 default target, which is the same for all organizations.
   • BThe industry average maturity level, since the company should match its peers.
   • CThe organization's risk appetite, business requirements, and the board's mandate for a highly mature program.
   • DThe Current Profile results, since the target should be realistic and achievable within the next year.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare organization is developing its Organizational Profile. The project manager has collected data from IT security, clinical engineering, and the privacy office. However, the manager is concerned that the profile may be incomplete because the organization's third-party vendors (e.g., a cloud EHR provider and a medical device supplier) have not been consulted. What is the most appropriate action?

   • AAsk the vendors to implement the same controls as the organization before including them in the profile.
   • BInclude the vendors' security documentation and contract terms as evidence when assessing relevant Subcategories.
   • CExclude vendor information because the profile should only reflect the organization's own internal controls.
   • DWait until the vendors provide their own complete NIST CSF profiles before proceeding.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A mid-sized bank is developing its Organizational Profile. The project team has limited time and resources. The team lead proposes to base the Current Profile primarily on existing security policies and audit reports, rather than conducting extensive new interviews. The compliance officer is concerned that this approach may miss important gaps. What is the most appropriate way to balance efficiency and accuracy?

   • ASkip the Current Profile and develop only the Target Profile, since the target is what matters for prioritization.
   • BUse existing documents as a starting point, but validate them with targeted interviews and evidence sampling in areas where the documents are outdated or incomplete.
   • CRely solely on existing documents, since they represent the official state of the organization's security program.
   • DConduct extensive interviews with every department to ensure no gaps are missed, regardless of the time and resource cost.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A university has completed its Current and Target Organizational Profiles. The gap analysis shows that the largest gaps are in the 'Protect' Function, specifically in identity management and access control (PR.AA). The CIO needs to present the findings to the board of trustees, who are not technical and are primarily concerned with budget and risk. How should the CIO communicate the profile results?

   • AFocus only on the gaps in the 'Govern' Function, since governance is the most important for the board to understand.
   • BPresent a detailed list of all Subcategory gaps with technical descriptions of each control deficiency.
   • CShare the raw profile data with the board and ask them to identify which gaps they think are most important.
   • DSummarize the top gaps in business terms, explain the associated risks, and propose prioritized investments with estimated costs and expected risk reduction.
   Reveal Solution Discussion Select an answer first