Understand the Concept of NIST CSF Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A small credit union is creating its first Organizational Profile. The team is unsure whether to include both current and target profiles. Which statement best explains why both are needed?

   • AThe current profile is based on the target profile, so both are needed for accuracy.
   • BThe target profile is used for external communication, while the current profile is internal.
   • CThe current profile is required by regulators, while the target profile is optional.
   • DThe current profile shows where the organization is, and the target profile shows where it wants to be, enabling gap analysis.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A utility company needs to explain its cybersecurity posture to state regulators. The regulators want a clear, consistent view of the company's current and desired security outcomes. Which use of Organizational Profiles best meets this need?

   • APresent a summary of all security incidents and their resolutions.
   • BPresent only the target profile to show the company's commitment to security.
   • CPresent both the current and target profiles to show the company's posture and improvement plans.
   • DPresent the list of security tools and vendors used.
   Reveal Solution Discussion Select an answer first
3. 33foundation · easy

   What does a current profile in the NIST CSF 2.0 represent?

   • AThe cybersecurity outcomes that the organization plans to achieve in the next fiscal year
   • BThe organization's existing cybersecurity posture based on current practices
   • CThe cybersecurity outcomes required by industry standards
   • DThe organization's desired cybersecurity outcomes for the future
   Reveal Solution Discussion Select an answer first