Explore Different Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which component is a key part of an Organizational Profile in the NIST CSF 2.0?

   • AA record of all employee training completion dates
   • BA list of specific software versions used across the organization
   • CA collection of threat intelligence feeds
   • DA set of outcomes selected from the CSF categories and subcategories
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A retail company has completed its Current and Target Profiles. The gap analysis shows that the company is at 'Partial' implementation for most Subcategories in the 'Protect' Function, but the Target Profile requires 'Risk Informed' or higher. The company has a limited budget and must decide which gaps to close first. Which approach best aligns with the purpose of the Organizational Profile?

   • AFocus on the cheapest gaps to close first to maximize the number of Subcategories improved.
   • BPrioritize gaps that address the highest-risk Subcategories, considering the company's specific threat landscape and business impact.
   • CClose all gaps in alphabetical order by Subcategory ID to ensure systematic coverage.
   • DAddress gaps in the 'Govern' Function first, since governance is the foundation of all other Functions.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When using Profiles to prioritize cybersecurity improvements, what should an organization consider?

   • AThe preferences of external auditors
   • BThe latest cybersecurity trends in the media
   • CThe number of security vendors used
   • DThe organization's risk tolerance and resource availability
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key purpose of communicating Organizational Profile results to stakeholders?

   • ATo replace the need for a security strategy
   • BTo assign blame for security incidents
   • CTo satisfy all regulatory requirements automatically
   • DTo support decision-making and resource allocation
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Who should be involved in the development of an Organizational Profile?

   • AOnly the IT security team
   • BOnly the Chief Information Security Officer (CISO)
   • COnly external cybersecurity consultants
   • DA cross-functional team including business and IT stakeholders
   Reveal Solution Discussion Select an answer first