NISTNIST CSFIdentify FunctionEASYFree question
In the NIST CSF Identify function, what is the purpose of the Risk Assessment category (ID.RA)?
- A.To catalog network segments, firewall rulesets, and monitoring tool configurations across sites
- B.To document escalation paths, on-call rotations, and communication templates for incident response
- C.To understand the cybersecurity risk to organizational operations, assets, and individuals
- D.To track patch levels, antivirus signatures, and log retention settings across managed devices
Why C is correct
Risk Assessment (ID.RA) is focused on understanding cybersecurity risk to organizational operations (including mission, functions, image, reputation), organizational assets, and individuals.
Know someone studying for NIST CSF? Send them this one.