Understand the Concept of NIST CSF Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A transportation authority is integrating cybersecurity into its enterprise risk management framework. The CISO wants to use Organizational Profiles to support this effort. Which outcome demonstrates successful integration?

   • ACybersecurity risks are considered alongside other business risks in decision-making.
   • BThe profiles are updated annually by the security team.
   • CThe profiles are used to generate compliance reports for auditors.
   • DThe profiles are stored in a secure repository accessible only to the security team.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A city government is creating its first Organizational Profile. The team is unsure what information to include. Which set of components is essential for a complete profile?

   • AThe names and roles of all cybersecurity staff.
   • BCurrent profile, target profile, and the gaps between them.
   • CA list of all security vendors and their product versions.
   • DThe organization's incident response plan and business continuity plan.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A logistics company wants to ensure that its cybersecurity investments are aligned with its enterprise risk management process. The CISO plans to use Organizational Profiles. Which action best integrates profiles into enterprise risk management?

   • AUse the profiles to inform risk decisions and prioritize cybersecurity activities based on business impact.
   • BKeep the profiles separate from the enterprise risk register to avoid complexity.
   • CUse the profiles only for compliance reporting to regulators.
   • DReplace the enterprise risk management process with the profiles.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software company is defining its target profile for the next fiscal year. The company plans to launch a new SaaS product and has a moderate risk tolerance. Which factor should most influence the target profile?

   • AThe current profile's weakest areas, to ensure they are improved.
   • BThe cybersecurity budgets of competitors.
   • CThe latest cybersecurity trends in the media.
   • DThe company's strategic business goals and risk appetite for the new product.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise is using Organizational Profiles to communicate cybersecurity risk to its board of directors. The board members have varying levels of technical expertise. The CISO needs to convey the gap analysis results in a way that supports strategic decisions. Which communication approach is most effective?

   • APresent the profiles using business-oriented language and visual summaries that highlight risk areas.
   • BProvide the full CSF Subcategory details for each gap to ensure transparency.
   • CShare the profiles only with the board's audit committee, as they are more technical.
   • DUse the profiles to demonstrate that the organization is fully aligned with the CSF.
   Reveal Solution Discussion Select an answer first