NISTNIST CSFProfiles RiskEASYFree question
What is the PRIMARY purpose of conducting a gap analysis between Current and Target Profiles?
- A.To generate compliance documentation
- B.To compare the organization against competitors
- C.To calculate the total cost of cybersecurity
- D.To identify differences between current and desired cybersecurity outcomes, enabling the creation of a prioritized action plan to address the gaps
Why D is correct
Gap analysis between Current and Target Profiles identifies specific differences between where the organization is and where it wants to be, providing the foundation for a prioritized, risk-informed improvement plan.
Know someone studying for NIST CSF? Send them this one.