Study. uk . com
  1. Home
  2. All questions
  3. Question 113

CISSP study material · question 113 of 500

An assessor treats the CSF Core as a checklist and reports the organisation as non-compliant because it addressed subcategories out of order. What is wrong with this reading?

  1. The Core states outcomes, and the order of its entries implies nothing about sequence or importance.
  2. Compliance is measured against Tiers rather than against the Core.
  3. Only subcategories with an implementation example attached are assessable.
  4. The Core is a checklist, but only the subcategories under Govern are mandatory.
Show the answer

Answer: A. The Core states outcomes, and the order of its entries implies nothing about sequence or importance.

CSF outcomes are not a list of actions to perform, and their order carries no meaning about the sequence or the importance of achieving them.

Source: NIST CSWP 29 (NIST) — NIST CSWP 29 > 2. Introduction to the CSF Core

Challenge yourself on this topic → Study as cards