Study. uk . com
  1. Home
  2. All questions
  3. Question 111

CISSP study material · question 111 of 500

A team says it has adopted the NIST Cybersecurity Framework because it has mapped its controls to the Core's subcategories. Which two further components does CSF 2.0 provide that they have not used? Choose two.

  1. An audit programme for certifying conformance to the framework.
  2. A control catalogue specifying the safeguards to implement.
  3. Tiers, which characterise how rigorous the risk practices are.
  4. Organizational Profiles, which describe current and target posture.
Show the answer

Answer: C. Tiers, which characterise how rigorous the risk practices are.
D. Organizational Profiles, which describe current and target posture.

CSF 2.0 has three components: the Core, Organizational Profiles and Tiers. It supplies neither a control catalogue nor a certification scheme, pointing instead to other resources.

Source: NIST CSWP 29 (NIST) — NIST CSWP 29 > 1. CSF Overview

Challenge yourself on this topic → Study as cards