NISTNIST CSFProtect FunctionEASYFree question
Why is Awareness and Training (PR.AT) included in the Protect function?
- A.To ensure vulnerabilities found during scanning are prioritized, and that remediation owners are assigned, tracked, and reported to leadership each month
- B.To ensure access permissions are reviewed on a schedule, and that dormant accounts are disabled, and that exceptions are logged for the audit trail
- C.To ensure backups are encrypted, and that restoration tests are performed on a recurring basis by the storage engineering team
- D.To ensure the organization's personnel and partners are provided cybersecurity awareness education and trained to perform their security-related duties, reducing human error risk
Why D is correct
Human error is a leading cause of security incidents. Awareness training ensures all users understand threats, their responsibilities, and how to recognize and respond to suspicious activities.
Know someone studying for NIST CSF? Send them this one.