Which model is commonly used to help organizations understand and communicate cybersecurity risk in financial terms to support enterprise risk decisions?

FAIR (Factor Analysis of Information Risk)

A large enterprise has a mature enterprise risk management program based on ISO 31000. The CISO wants to integrate cybersecurity risk but is concerned that the current risk assessment process does not capture cyber-specific threats like advanced persistent threats. The enterprise risk team is reluctant to change the process. What is the best approach?

Ask the enterprise risk team to add a generic 'cyber' category to the existing risk taxonomy without changing the assessment process.

Convince the enterprise risk team to replace ISO 31000 with the NIST CSF.

Use the NIST Cybersecurity Framework to identify cyber-specific risks and then translate them into the ISO 31000 risk language for the enterprise risk register.

Create a separate cyber risk register and do not include it in the enterprise risk register.

A company's enterprise risk committee is reviewing the annual risk assessment. The CISO wants to ensure cybersecurity risks are prioritized consistently with other enterprise risks. What is the most effective way to achieve this?

Use the same risk scoring methodology for cybersecurity risks as for other enterprise risks.

Prioritize cybersecurity risks based on the likelihood of attack.

Prioritize cybersecurity risks based on the cost of mitigation.

Prioritize cybersecurity risks based on the CISO's judgment.

What is the purpose of aligning cybersecurity risk governance with enterprise risk governance processes?

To ensure that only the CISO makes risk decisions.

To ensure cybersecurity risks are overseen and reported through the same channels as other enterprise risks.

To eliminate the need for any risk governance.

To create a separate governance structure exclusively for cybersecurity.

Which group of stakeholders is most essential to engage when integrating cybersecurity risk into enterprise risk decisions?

Executive leadership and board members

Dell NIST Cybersecurity Framework v2.0

Domain 10Objective 3

Integrate Cybersecurity Risk Management into Broader Enterprise Risk Management Programs. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Part of the Assess Cybersecurity Risk Communication and Integration domain, which accounts for 10% of the NIST-CYBERSECURITY-FRAMEWORK-2 exam.

28questions here

6free pages

5concepts

10%of the exam

Questions 1–5

1foundation · easy
Which model is commonly used to help organizations understand and communicate cybersecurity risk in financial terms to support enterprise risk decisions?
Select an answer first
2expert · hard
A large enterprise has a mature enterprise risk management program based on ISO 31000. The CISO wants to integrate cybersecurity risk but is concerned that the current risk assessment process does not capture cyber-specific threats like advanced persistent threats. The enterprise risk team is reluctant to change the process. What is the best approach?
Select an answer first
3application · medium
A company's enterprise risk committee is reviewing the annual risk assessment. The CISO wants to ensure cybersecurity risks are prioritized consistently with other enterprise risks. What is the most effective way to achieve this?
Select an answer first
4foundation · easy
What is the purpose of aligning cybersecurity risk governance with enterprise risk governance processes?
Select an answer first
5foundation · easy
Which group of stakeholders is most essential to engage when integrating cybersecurity risk into enterprise risk decisions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NIST-CYBERSECURITY-FRAMEWORK-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Dell Technologies. “NIST-CYBERSECURITY-FRAMEWORK-2” is a trademark of its owner, used for identification only.