Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is preparing for an external audit that will assess both its security governance and its technical controls. The audit team is familiar with the NIST CSF but not the CIS Controls. The CISO wants to use the CIS Controls to demonstrate compliance. What is the most effective strategy?

   • AProvide the auditors with a mapping of CIS Controls to NIST CSF functions and categories, along with evidence of implementation.
   • BAsk the auditors to learn the CIS Controls before the audit, since they are the organization's chosen framework.
   • CSwitch to the NIST CSF entirely and drop the CIS Controls to align with the auditors.
   • DReport only the CIS Controls implementation status and let the auditors figure out the mapping.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security manager is reviewing an old policy document that references 'CIS Critical Security Controls v6.1' and its five 'Critical Security Controls' categories. The organization is now adopting CIS Controls v8. What is the most important change to communicate to the team?

   • ACIS Controls v8 is identical to v7.1 except for the numbering of the controls.
   • BCIS Controls v8 consolidated the controls into a single set of 18 controls with Implementation Groups, replacing the older categories.
   • CCIS Controls v8 renamed the controls to 'CIS Critical Security Controls' and kept the same five categories.
   • DCIS Controls v8 removed all cloud and mobile device safeguards, focusing only on on-premises systems.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Implementation Group (IG) is intended for organizations with limited cybersecurity expertise and resources?

   • AIG2
   • BIG3
   • CIG0
   • DIG1
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A hospital system's board of directors wants to ensure that cybersecurity investments align with patient safety and operational continuity. The CISO proposes adopting the CIS Controls as the basis for the security program. Which governance outcome does this best support?

   • AProviding a prioritized, risk-based framework that links security actions to organizational objectives.
   • BReplacing the need for board-level risk oversight because the controls are self-managing.
   • CAutomatically satisfying all healthcare regulations without additional compliance work.
   • DGuaranteeing that all cyber threats are eliminated, ensuring patient safety at all times.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A government contractor must align its security program with the NIST Cybersecurity Framework (CSF) for a federal contract. The contractor has already implemented the CIS Controls. How can the contractor best leverage the CIS Controls to satisfy the NIST CSF requirement?

   • AImplement NIST CSF only for the contract and ignore the CIS Controls.
   • BReplace the CIS Controls with NIST CSF because they are incompatible.
   • CUse the published mapping between CIS Controls and NIST CSF to demonstrate coverage of CSF functions and categories.
   • DUse the CIS Benchmarks as the primary framework for the contract.
   Reveal Solution Discussion Select an answer first