A manufacturing company's board of directors is composed primarily of financial and operations executives. The CISO must present the top cybersecurity risks for the upcoming year. Which communication approach would be most effective for this audience?

Present a detailed technical analysis of the vulnerabilities and exploit paths for each risk.

Translate each risk into potential financial loss, operational downtime, and regulatory impact using business language.

Recommend that the board delegate cybersecurity risk oversight to the audit committee to avoid overwhelming them.

Focus on the number of security incidents and the percentage of patched systems as key performance indicators.

A mid-sized company is establishing an enterprise risk management program. The CISO wants to ensure cybersecurity risk is included from the start. What is the most effective way to align cybersecurity risk governance with the new enterprise risk governance structure?

Include the CISO in the enterprise risk committee and define cybersecurity risk criteria using the same language as other risks.

Create a separate cybersecurity risk governance structure that reports to the CEO.

Wait until the enterprise risk program is mature before integrating cybersecurity risk.

Use a different risk appetite for cybersecurity than for other enterprise risks.

A CISO is developing a cybersecurity risk register. To integrate it with the enterprise risk register, what is the most important thing to do?

Include only high-impact cybersecurity risks in the register.

Use a different risk scoring scale for cybersecurity risks.

Keep the cybersecurity risk register separate from the enterprise risk register.

Use the same risk categories and terminology as the enterprise risk register.

A multinational corporation is preparing its annual enterprise risk report. The CISO has identified a high-impact cyber risk that could affect multiple business units. The enterprise risk team wants to include it in the report, but the business unit leaders are concerned that highlighting the risk will invite regulatory scrutiny. The CISO must ensure the risk is communicated accurately while addressing the leaders' concerns. What is the best course of action?

Delay the report until the risk is fully mitigated to avoid reporting an unresolved issue.

Report the risk only to the audit committee and keep it out of the main enterprise risk report.

Exclude the risk from the report to avoid regulatory attention and address it internally.

Include the risk in the report with a clear explanation of the business impact and the mitigation strategy in place.

What is the primary purpose of integrating cybersecurity risk management into broader enterprise risk management programs?

To isolate cybersecurity risk from other enterprise risks so it can be managed independently.

To guarantee that all cybersecurity risks are eliminated before any business initiative proceeds.

To replace all other risk management activities with a single cybersecurity-focused process.

To ensure that cybersecurity risks are considered alongside other business risks when making enterprise-level decisions.

Dell NIST Cybersecurity Framework v2.0

Domain 10Objective 3

Integrate Cybersecurity Risk Management into Broader Enterprise Risk Management Programs. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Part of the Assess Cybersecurity Risk Communication and Integration domain, which accounts for 10% of the NIST-CYBERSECURITY-FRAMEWORK-2 exam.

28questions here

6free pages

5concepts

10%of the exam

Questions 16–20

16application · medium
A manufacturing company's board of directors is composed primarily of financial and operations executives. The CISO must present the top cybersecurity risks for the upcoming year. Which communication approach would be most effective for this audience?
Select an answer first
17application · medium
A mid-sized company is establishing an enterprise risk management program. The CISO wants to ensure cybersecurity risk is included from the start. What is the most effective way to align cybersecurity risk governance with the new enterprise risk governance structure?
Select an answer first
18application · medium
A CISO is developing a cybersecurity risk register. To integrate it with the enterprise risk register, what is the most important thing to do?
Select an answer first
19expert · hard
A multinational corporation is preparing its annual enterprise risk report. The CISO has identified a high-impact cyber risk that could affect multiple business units. The enterprise risk team wants to include it in the report, but the business unit leaders are concerned that highlighting the risk will invite regulatory scrutiny. The CISO must ensure the risk is communicated accurately while addressing the leaders' concerns. What is the best course of action?
Select an answer first
20foundation · easy
What is the primary purpose of integrating cybersecurity risk management into broader enterprise risk management programs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NIST-CYBERSECURITY-FRAMEWORK-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Dell Technologies. “NIST-CYBERSECURITY-FRAMEWORK-2” is a trademark of its owner, used for identification only.