Study. uk . com
  1. Home
  2. All questions
  3. Question 1

CISM study material · question 1 of 1000

A security manager is presenting the organisation's adoption of NIST CSF 2.0 to the board. A director asks why Govern is drawn at the centre of the framework wheel rather than as the first step in a sequence. What is the most accurate explanation?

  1. Govern replaces the risk assessment work of Identify, so once governance outcomes are agreed the other functions inherit them unchanged
  2. Govern shapes how the other five functions are carried out, rather than preceding or following them
  3. Govern must be completed and signed off before Identify can begin
  4. Govern is the only function that applies to the whole organisation
Show the answer

Answer: B. Govern shapes how the other five functions are carried out, rather than preceding or following them

CSF 2.0 places Govern at the centre because it informs how the other five functions are implemented. It is continuous and contextual, not a gate that closes before Identify opens.

Source: NIST CSWP 29 (NIST) — Sec. 2 Introduction to the CSF Core

Challenge yourself on this topic → Study as cards