NISTNIST CSFProfiles RiskEASYFree question
What is the difference between a Current Profile and a Target Profile?
- A.A Current Profile lists the controls the organization plans to purchase next fiscal year, while a Target Profile lists the controls that auditors found missing during the prior assessment cycle
- B.A Current Profile records outcomes the board has formally approved, while a Target Profile records outcomes the security team has already deployed
- C.A Current Profile describes the cybersecurity outcomes currently being achieved, while a Target Profile describes the desired cybersecurity outcomes the organization aims to achieve
- D.A Current Profile covers the corporate IT network, while a Target Profile covers the operational technology network at plants
Why C is correct
The Current Profile captures the cybersecurity outcomes presently being achieved, while the Target Profile represents the desired future state, creating a basis for gap analysis and improvement planning.
Know someone studying for NIST CSF? Send them this one.