Explore Different Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   Which of the following is a recommended first step in developing an Organizational Profile in NIST CSF 2.0?

   • AIdentifying the organization's mission and cybersecurity objectives
   • BConducting a penetration test of all systems
   • CPurchasing a cybersecurity insurance policy
   • DSelecting specific security software products
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A technology company has a Current Profile that shows strong implementation in most Subcategories. However, the company's Target Profile, developed two years ago, is now considered outdated because the company has shifted its business model to cloud-based services. The CISO must decide how to update the profiles. What is the most appropriate action?

   • AKeep the existing Target Profile, since it represents the organization's long-term goals and should not change with business model shifts.
   • BUpdate only the Current Profile to reflect the new cloud environment, and keep the Target Profile unchanged.
   • CReassess both the Current and Target Profiles to reflect the new cloud-based business model, and use the updated gap analysis to reprioritize improvements.
   • DDiscard both profiles and start from scratch, since the business model change makes the old profiles irrelevant.
   Reveal Solution Discussion Select an answer first