Study. uk . com
  1. Home
  2. All questions
  3. Question 12

CISSP study material · question 12 of 500

A mid-sized utility sits at the Partial Tier under the NIST Cybersecurity Framework 2.0. A consultant urges an immediate push to Adaptive on the grounds that higher is always better. The chief risk officer wants a defensible position. When does moving to a higher Tier make sense?

  1. When rising threats, new mandates or a favourable cost-benefit case justify the added rigour
  2. Once a Target Profile is complete, since Tiers are what replaces a formal risk methodology
  3. After an external assessor certifies the current Tier, since progression requires attestation
  4. Whenever the budget allows, since Tiers form a maturity ladder every organisation should climb
Show the answer

Answer: A. When rising threats, new mandates or a favourable cost-benefit case justify the added rigour

Tiers describe governance rigour and inform Profiles rather than replacing a risk methodology; advancing is warranted when threats, requirements or cost-benefit justify it, never automatically.

Source: NIST CSWP 29 (NIST) — CSF 2.0 > Section 3.2, CSF Tiers

Challenge yourself on this topic → Study as cards