Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A publicly traded company must report its cybersecurity risk posture to the board and auditors. The CISO wants to use the CIS Controls to support governance reporting. Which practice best demonstrates the use of CIS Controls in this governance process?

   • AReport only the number of controls that are fully implemented, without context.
   • BPublish the full CIS Controls document in the annual report.
   • CTrack implementation status of each CIS Control and map it to business risks and regulatory requirements.
   • DUse the CIS Controls as a substitute for the annual external audit.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A non-profit organization with a small IT team is starting a cybersecurity program from scratch. They have limited budget and need to prioritize actions that will have the greatest impact. Which approach aligns with the purpose of the CIS Controls?

   • AWait until a formal risk assessment is completed before implementing any controls.
   • BImplement controls based on the latest security trends rather than a structured framework.
   • CPurchase a comprehensive security product suite and implement it all at once.
   • DImplement the CIS Controls in order of priority, starting with the foundational safeguards in IG1.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary role of cybersecurity governance in an organization?

   • ATo implement specific technical security controls and monitor their effectiveness
   • BTo ensure that cybersecurity strategies align with organizational objectives and manage risk effectively
   • CTo purchase and deploy security software and hardware for the organization
   • DTo provide a detailed set of step-by-step instructions for responding to security incidents
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A global logistics company has a decentralized IT structure, with each regional office managing its own security. The board is concerned about inconsistent security practices and wants to establish a unified governance approach. The CISO proposes using the CIS Controls as a common framework. Which implementation strategy best addresses the board's concern?

   • AEstablish a central governance body that sets minimum CIS Controls requirements for all regions, while allowing regional adaptation based on local risk.
   • BAllow each region to implement the CIS Controls independently without central oversight.
   • COutsource security governance to a single global provider to ensure uniformity.
   • DMandate that all regions implement the same IG3 controls regardless of local risk.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A university's IT department wants to improve its cybersecurity posture but the administration is concerned about cost. The CISO proposes using the CIS Controls to guide investment. Which statement best reflects the governance value of this approach?

   • AThe CIS Controls guarantee that the university will not experience a data breach.
   • BThe CIS Controls are free, so implementing them will eliminate all cybersecurity costs.
   • CThe CIS Controls help prioritize investments based on risk, ensuring that limited funds address the most impactful safeguards first.
   • DThe CIS Controls are only useful for large enterprises, so the university should not adopt them.
   Reveal Solution Discussion Select an answer first