NISTNIST CSFProfiles RiskEASYFree question
What is the difference between a Current Profile and a Target Profile?
- A.There is no meaningful difference between them
- B.A Current Profile describes the cybersecurity outcomes currently being achieved, while a Target Profile describes the desired cybersecurity outcomes the organization aims to achieve
- C.A Current Profile is for IT systems and a Target Profile is for business processes
- D.A Target Profile is always the same as a peer organization's profile
Why B is correct
The Current Profile captures the cybersecurity outcomes presently being achieved, while the Target Profile represents the desired future state, creating a basis for gap analysis and improvement planning.
Know someone studying for NIST CSF? Send them this one.