NISTNIST CSFIdentify FunctionEASYFree question
What is the relationship between the Identify function and an organization's risk tolerance?
- A.The Identify function eliminates all risk
- B.Risk tolerance is not addressed in the NIST CSF
- C.The Identify function helps establish and communicate the organization's risk tolerance, which guides decisions about acceptable risk levels and resource allocation for cybersecurity
- D.The Identify function sets a fixed risk tolerance for all organizations
Why C is correct
Understanding risk tolerance is a key outcome of the Identify function, enabling the organization to make informed decisions about which risks to accept, mitigate, transfer, or avoid.
Know someone studying for NIST CSF? Send them this one.