Integrate Cybersecurity Risk Management into Broader Enterprise Risk Management Programs. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which communication approach is most effective when presenting cybersecurity risk to enterprise-level stakeholders?

   • AUsing highly technical language to demonstrate the severity of the risk.
   • BFocusing on business impact and risk in terms that align with enterprise risk language.
   • CReporting only successful attacks and ignoring potential vulnerabilities.
   • DSharing detailed exploit code to illustrate the threat.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A regional bank's enterprise risk committee meets quarterly and reviews operational, credit, and market risk. The CISO wants cybersecurity risk to be considered alongside these. The committee chair is concerned that adding a separate cybersecurity agenda item will overwhelm the meeting. What is the most effective approach for the CISO to take?

   • AMap each top cybersecurity risk to the enterprise risk taxonomy and present them within the existing risk categories.
   • BRecommend that the committee adopt a new enterprise risk management software platform that includes cybersecurity modules.
   • CProvide the committee with a standalone cybersecurity risk register and ask them to review it outside the meeting.
   • DRequest a dedicated quarterly cybersecurity risk meeting with the board and executive leadership.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization wants to integrate its cybersecurity risk management with its enterprise risk management program. The organization already uses ISO 31000 for enterprise risk and wants a framework that aligns cybersecurity risk with that structure. Which approach best meets this need?

   • ACreate a separate cybersecurity risk register that is not linked to the enterprise risk register.
   • BReplace ISO 31000 with the NIST Cybersecurity Framework for all enterprise risk management.
   • CUse the NIST Cybersecurity Framework to identify and assess cybersecurity risks, then map them into the ISO 31000 risk categories and processes.
   • DAdopt the NIST Cybersecurity Framework as a standalone program and report separately to the board.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A government agency uses the NIST Risk Management Framework (RMF) for its cybersecurity program and the GAO's Framework for Managing Improper Payments for enterprise risk. The agency wants to integrate cybersecurity risk into its enterprise risk management without duplicating efforts. What is the most effective approach?

   • AMap the NIST RMF risk categories to the GAO framework's risk categories and use the same risk scoring scale.
   • BRun the two frameworks in parallel and report cybersecurity risk separately to the agency head.
   • CReplace the GAO framework with the NIST RMF for all enterprise risk management.
   • DUse the NIST RMF only for high-impact systems and the GAO framework for everything else.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A utility company is planning a major cybersecurity investment. The CFO is skeptical because the ROI is unclear, and the operations director is concerned about downtime during implementation. The CISO must gain approval from the executive committee. What is the best way to engage these stakeholders?

   • AAsk the board to mandate the investment without further discussion.
   • BProvide a cost-benefit analysis that quantifies potential losses from cyber incidents and a phased implementation plan to minimize downtime.
   • CPresent the investment as a compliance requirement to avoid debate.
   • DFocus on the technical details of the solution to demonstrate its effectiveness.
   Reveal Solution Discussion Select an answer first