Integrate Cybersecurity Risk Management into Broader Enterprise Risk Management Programs. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A large retail company is updating its enterprise risk appetite statement. The CISO wants cybersecurity risk to be explicitly included. Which stakeholder group must be engaged to ensure the risk appetite statement reflects the organization's tolerance for cyber risk?

   • AThe marketing and public relations departments
   • BExternal security vendors and consultants
   • CThe IT help desk and system administrators
   • DThe board of directors and executive leadership team
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's enterprise risk committee uses a risk matrix with likelihood and impact scales. The CISO wants to ensure cybersecurity risks are assessed using the same scales. What is the best way to achieve this?

   • AUse the enterprise risk matrix and define cybersecurity-specific criteria for likelihood and impact.
   • BUse qualitative assessments for cybersecurity and quantitative for other risks.
   • CHave the IT team assess cybersecurity risks and report them separately.
   • DDevelop a separate cybersecurity risk matrix with its own scales.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services firm has an enterprise risk committee that oversees all risk types. The CISO wants to ensure cybersecurity risk is governed consistently with other risks. What is the most effective way to achieve this alignment?

   • AHave the CISO report directly to the enterprise risk committee and use the same risk escalation and reporting processes as other risk types.
   • BDelegate all cybersecurity risk decisions to the IT department without committee oversight.
   • CEstablish a separate cybersecurity risk committee that reports directly to the CEO.
   • DUse a different risk assessment methodology for cybersecurity than for other enterprise risks.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A CISO needs to explain the concept of cybersecurity risk to a new enterprise risk manager who is unfamiliar with the domain. Which approach is most effective?

   • AUse the NIST Cybersecurity Framework's functions (Identify, Protect, Detect, Respond, Recover) to structure the explanation.
   • BRecommend that the risk manager take a cybersecurity training course.
   • CExplain cybersecurity risk in terms of the latest security technologies.
   • DProvide a detailed list of all current threats and vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A CISO is preparing a quarterly risk report for the board. The board is interested in the top risks and the effectiveness of mitigation efforts. What is the most effective way to present this information?

   • APresent a dashboard showing key risk indicators, trends, and the status of top mitigation initiatives.
   • BList all identified risks with their technical details and mitigation status.
   • CFocus only on risks that have been fully mitigated.
   • DProvide a detailed report of all security incidents that occurred during the quarter.
   Reveal Solution Discussion Select an answer first