Study. uk . com
  1. Home
  2. All questions
  3. Question 129

CISSP study material · question 129 of 500

A small logistics firm believes the NIST Cybersecurity Framework is meant only for critical infrastructure operators. What changed with version 2.0 that answers this?

  1. Version 2.0 added a small-business Tier below Partial.
  2. The old title referring to critical infrastructure was dropped, reflecting use by organisations of every sector and size.
  3. Version 2.0 made the framework mandatory only for critical infrastructure and voluntary elsewhere.
  4. Version 2.0 replaced the Core with sector-specific Community Profiles.
Show the answer

Answer: B. The old title referring to critical infrastructure was dropped, reflecting use by organisations of every sector and size.

Before 2.0 the framework was titled for improving critical infrastructure cybersecurity; the title was dropped because the framework serves organisations of all sizes and sectors.

Source: NIST CSWP 29 (NIST) — NIST CSWP 29 > Note to Readers

Challenge yourself on this topic → Study as cards