NISTNIST CSFIdentify FunctionEASYFree question
What is the purpose of Risk Assessment (ID.RA) in the NIST CSF?
- A.To document network segments, firewall rulesets, and monitoring tool configurations by cataloging devices, credentials, versions, and patch levels
- B.To understand cybersecurity risks to organizational operations, assets, and individuals by identifying threats, vulnerabilities, impacts, and likelihood
- C.To schedule staffing rotations, on-call coverage, and escalation contacts by mapping shifts, holidays, backups, and overtime approvals
- D.To track backup retention, recovery objectives, and failover procedures by recording schedules, targets, tests, and last verification dates
Why B is correct
Risk Assessment identifies and evaluates cybersecurity risks by analyzing threats, vulnerabilities, likelihoods, and potential impacts to prioritize risk response activities.
Know someone studying for NIST CSF? Send them this one.