NISTNIST CSFProfiles RiskEASYFree question
What is the difference between a Current Profile and a Target Profile?
- A.There is no meaningful difference between them
- B.A Target Profile is always the same as a peer organization's profile
- C.A Current Profile describes the cybersecurity outcomes currently being achieved, while a Target Profile describes the desired cybersecurity outcomes the organization aims to achieve
- D.A Current Profile is for IT systems and a Target Profile is for business processes, as the CSF requires that a single named executive personally sign every Subcategory determination
Why C is correct
The Current Profile captures the cybersecurity outcomes presently being achieved, while the Target Profile represents the desired future state, creating a basis for gap analysis and improvement planning.
Know someone studying for NIST CSF? Send them this one.