NISTNIST CSFGovern FunctionEASYFree question
What does the Risk Management Strategy category (GV.RM) within the Govern function establish?
- A.The board's meeting cadence, committee charters, escalation thresholds, and reporting templates that support cybersecurity oversight activities
- B.The vendor's contractual obligations, audit rights, breach notification windows, and termination clauses that govern third-party relationships
- C.The organization's priorities, constraints, risk tolerance statements, and assumptions that support risk management decisions
- D.The workforce's required certifications, training hours, rotation schedules, and staffing levels that support security operations capacity
Why C is correct
Risk Management Strategy (GV.RM) establishes the organization's priorities, constraints, risk tolerance statements, and assumptions used to support operational risk decisions within the cybersecurity program.
Know someone studying for NIST CSF? Send them this one.