NISTNIST CSFProfiles RiskEASYFree question
Can an organization create multiple Framework Profiles?
- A.Yes, organizations can create profiles for different business lines, subsidiaries, or specific systems to address their unique requirements
- B.No, a single enterprise-wide Profile is required, with business units adopting its outcomes without local variation
- C.Yes, though each Profile must be registered with NIST before the organization can use it in assessments
- D.Yes, though additional Profiles are limited to external suppliers rather than internal teams, per Framework guidance
Why A is correct
Organizations can create multiple profiles tailored to different business lines, subsidiaries, operational environments, or specific critical systems, each reflecting the unique cybersecurity requirements of that context.
Know someone studying for NIST CSF? Send them this one.