Study. uk . com
  1. Home
  2. All questions
  3. Question 10

CISSP study material · question 10 of 500

A software firm's leadership expects the NIST Cybersecurity Framework 2.0 to hand them a configuration standard for their cloud estate. The security lead has to reset that expectation before the programme starts. What does the framework itself provide?

  1. A vocabulary of cybersecurity outcomes, with implementation left to the resources it points to
  2. A maturity certification scheme against which an organisation is audited by a third party
  3. A prescriptive control baseline that organisations tailor by removing controls they can justify
  4. A technical configuration standard for cloud workloads, with sector variations published separately
Show the answer

Answer: A. A vocabulary of cybersecurity outcomes, with implementation left to the resources it points to

CSF 2.0 describes outcomes and deliberately declines to prescribe how to reach them, referring readers to external resources; it is neither a control baseline nor a certification scheme.

Source: NIST CSWP 29 (NIST) — CSWP 29 > Abstract

Challenge yourself on this topic → Study as cards