NISTNIST CSFFramework ImplementationEASYFree question
Are organizations required to achieve Tier 4 (Adaptive) to be considered compliant with the NIST CSF?
- A.Yes, the Framework mandates Tier 3 for critical infrastructure operators and Tier 4 for federal agencies
- B.Yes, Tier 4 is the stated baseline for regulated sectors and a lower tier is reported to the regulator
- C.No, the Tiers are not meant to represent maturity levels and the appropriate tier depends on the organization's risk environment and resources
- D.No, Tier 2 is the compliance floor for the private sector and Tier 3 applies to government contractors
Why C is correct
The Tiers are not prescriptive maturity levels. Organizations should select the target tier that best manages their cybersecurity risk given their threat environment, business requirements, and available resources.
Know someone studying for NIST CSF? Send them this one.