Explore Different Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large hospital system has completed its Current and Target Profiles. The gap analysis shows that the system is strong in 'Protect' but weak in 'Recover' and 'Respond'. The board is concerned about the recent ransomware attacks in the healthcare sector and wants to know how the profile addresses this threat. The CISO must present the findings. What is the most effective way to communicate the profile results to the board in this context?

   • AHighlight the system's strengths in Protect to reassure the board that the organization is well-defended against ransomware.
   • BPresent the full profile to the board and ask them to identify which gaps they think are most relevant to ransomware.
   • CExplain that the gaps in Recover and Respond directly affect the system's ability to recover from ransomware, and propose investments to close those gaps as a priority.
   • DFocus on the gaps in the 'Govern' Function, since governance is the foundation of all cybersecurity activities.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do Organizational Profiles help prioritize cybersecurity improvements?

   • ABy automatically implementing security controls
   • BBy ranking all employees based on security awareness
   • CBy identifying gaps between the Current and Target Profiles
   • DBy calculating the exact cost of every security control
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the primary purpose of an Organizational Profile?

   • ATo assign a single maturity score to the entire organization
   • BTo provide a detailed technical implementation plan for each security control
   • CTo list all cybersecurity incidents that have occurred in the past year
   • DTo summarize an organization's cybersecurity posture in terms of Framework outcomes
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A multinational corporation has completed its Current and Target Profiles. The gap analysis reveals that the largest gaps are in the 'Protect' Function (PR.AA and PR.DS), but the 'Govern' Function (GV.OC) also has significant gaps. The corporation's risk committee has mandated that all gaps be closed within 18 months, but the budget is only sufficient to close approximately half of the identified gaps. The CISO must decide how to proceed. Which approach best balances the mandate and the budget constraint?

   • ARequest a budget increase from the risk committee to close all gaps, since the mandate requires it.
   • BPrioritize the gaps in PR.AA and PR.DS, since they represent the largest risk reduction, and communicate to the risk committee that the remaining gaps will require additional budget or timeline adjustment.
   • CClose the gaps in GV.OC first, since governance gaps affect the entire organization and will make future improvements easier.
   • DReduce the Target Profile to match the Current Profile so that the gaps disappear and the mandate is technically met.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary role of a Target Profile in the NIST CSF 2.0?

   • ATo describe the desired cybersecurity outcomes aligned with organizational goals
   • BTo compare the organization to industry competitors
   • CTo list all cybersecurity technologies currently in use
   • DTo document past cybersecurity incidents
   Reveal Solution Discussion Select an answer first