Understand the Concept of NIST CSF Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why might an organization create an Organizational Profile using the NIST CSF 2.0?

   • ATo align its cybersecurity activities with its business requirements and risk tolerance
   • BTo satisfy a legal requirement that all organizations use the NIST CSF
   • CTo automatically generate a list of all security vulnerabilities in the organization
   • DTo replace the need for any other cybersecurity documentation
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How do Organizational Profiles facilitate communication about cybersecurity risk?

   • ABy encrypting all internal communications
   • BBy providing a common language for discussing cybersecurity outcomes
   • CBy creating a public website for the organization's security team
   • DBy automatically sending alerts to all employees about security threats
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital network has completed its current and target profiles. The board wants to know which gaps pose the greatest risk to patient safety. Which analysis should the CISO perform?

   • ACompare the hospital's profiles to those of other hospitals.
   • BIdentify gaps that are easiest to fix and present those as priorities.
   • CMap the gaps to the organization's risk register and assess their potential impact on patient care.
   • DCount the number of gaps in each CSF Function and report the totals.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How do Organizational Profiles support the integration of cybersecurity risk into enterprise risk management?

   • ABy eliminating the need for separate risk assessments
   • BBy providing a structured way to align cybersecurity outcomes with business objectives
   • CBy automatically transferring all cybersecurity risk to insurance providers
   • DBy creating a separate cybersecurity risk register that is not shared with other departments
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm needs to communicate its cybersecurity posture to a new business partner who requires assurance that the firm meets industry expectations. Which use of Organizational Profiles best supports this communication?

   • AShare the list of all security incidents from the past year.
   • BShare the gap analysis results without the profiles.
   • CShare the target profile to demonstrate the desired level of security.
   • DShare the current profile to show the actual cybersecurity outcomes achieved.
   Reveal Solution Discussion Select an answer first