Study. uk . com
  1. Home
  2. All questions
  3. Question 121

CISSP study material · question 121 of 500

A team complains that the CSF 2.0 document tells them what outcomes to reach but never how to reach them. Where does CSF 2.0 direct them for the how?

  1. Appendix B, which lists mandatory controls per subcategory.
  2. The Community Profile for their sector, which is normative.
  3. The Tier definitions, which describe the practices at each level.
  4. Informative References, Implementation Examples and Quick Start Guides.
Show the answer

Answer: D. Informative References, Implementation Examples and Quick Start Guides.

CSF 2.0 deliberately prescribes neither outcomes nor how to achieve them; supplementary online resources - references, examples and quick start guides - carry the implementation guidance.

Source: NIST CSWP 29 (NIST) — NIST CSWP 29 > 1. CSF Overview

Challenge yourself on this topic → Study as cards