Integrate Cybersecurity Risk Management into Broader Enterprise Risk Management Programs. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key benefit of using consistent risk terminology when communicating cybersecurity risks to enterprise stakeholders?

   • AIt guarantees that all risks will be accepted by leadership.
   • BIt helps stakeholders compare cybersecurity risks with other enterprise risks.
   • CIt ensures that only technical staff can understand the risks.
   • DIt eliminates the need for any risk assessments.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which practice best supports alignment between cybersecurity risk governance and enterprise risk governance?

   • AKeeping cybersecurity risk documentation separate from all other risk documentation.
   • BIncluding cybersecurity risk in the enterprise risk register and reporting it through the same escalation path.
   • CReporting cybersecurity risks only to the IT department.
   • DUsing different risk scales for cybersecurity than for other risks.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A hospital system is integrating cybersecurity risk into its enterprise risk management. The clinical staff are concerned that new security controls will slow down access to patient data. The CFO is concerned about the cost of the controls. The CISO must balance these concerns while ensuring patient safety and compliance. What is the best approach?

   • AImplement the security controls and require clinical staff to use multi-factor authentication, even if it slows access.
   • BImplement only the controls required by regulation and ignore other risks.
   • CEngage clinical staff and the CFO in a risk assessment to identify controls that minimize disruption and cost while protecting patient data.
   • DDefer the security controls until the next budget cycle to address the CFO's cost concern.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does cybersecurity risk management best support a broader enterprise risk management program?

   • ABy requiring that cybersecurity risks be reported only to the IT department.
   • BBy ensuring that all cybersecurity risks are transferred to third-party insurers.
   • CBy focusing exclusively on technical vulnerabilities without considering business impact.
   • DBy providing a risk perspective that helps leadership understand potential impacts on business objectives.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary reason to involve business unit managers in cybersecurity risk discussions?

   • AThey have the final authority to accept all risks.
   • BThey understand the operational impact of risks on their specific business functions.
   • CThey are the only ones who can implement technical security controls.
   • DThey are responsible for all cybersecurity incidents.
   Reveal Solution Discussion Select an answer first