Study. uk . com
  1. Home
  2. All questions
  3. Question 154

CISM study material · question 154 of 1000

An implementation team treats every CSF subcategory as a mandatory action item to be ticked off. Why is this a misreading of the framework?

  1. Subcategories express specific outcomes, not a checklist of required actions
  2. Subcategories are examples that an organisation may safely ignore once it has adopted a recognised control framework
  3. Subcategories are exhaustive and no further action is possible
  4. Subcategories apply only to the Govern function
Show the answer

Answer: A. Subcategories express specific outcomes, not a checklist of required actions

The CSF Core is a hierarchy of functions, categories and subcategories describing outcomes. Actions taken to achieve an outcome vary by organisation and use case; the Core is not a checklist.

Source: NIST CSWP 29 (NIST) — Sec. 2 Introduction to the CSF Core

Challenge yourself on this topic → Study as cards