Study. uk . com
  1. Home
  2. All questions
  3. Question 158

CISM study material · question 158 of 1000

An organisation wants separate CSF Profiles for its payments platform and for its ransomware readiness. Is this consistent with the framework?

  1. No — profiles may be scoped only to whole legal entities
  2. No — an organisation may hold only one Organizational Profile at a time
  3. Yes, but only if each is approved separately by the regulator
  4. Yes — an organisation may hold as many profiles as it wishes, each with a different scope
Show the answer

Answer: D. Yes — an organisation may hold as many profiles as it wishes, each with a different scope

CSF 2.0 puts no ceiling on the number of Organizational Profiles: each may take whatever scope is useful, from the whole organisation down to one system set or one threat like ransomware.

Source: NIST CSWP 29 (NIST) — Sec. 3.1 CSF Profiles

Challenge yourself on this topic → Study as cards