Study. uk . com
  1. Home
  2. All questions
  3. Question 7

CISM study material · question 7 of 1000

A security strategy names supply chain risk as its highest priority, yet the budget allocates almost nothing to supplier assurance while funding a large endpoint refresh. Which CSF 2.0 Govern outcome is not being satisfied?

  1. Roles, responsibilities and authorities for supplier assurance are established, documented and enforced
  2. Resources are allocated commensurate with the risk strategy, roles and policies
  3. Cybersecurity is included in human resources practices such as screening, onboarding and role change
  4. Policy is reviewed, updated and reissued whenever the threat environment materially changes
Show the answer

Answer: B. Resources are allocated commensurate with the risk strategy, roles and policies

CSF 2.0 ties budget to stated risk direction: resources are to be allocated in proportion to the risk strategy and the roles and policies it defines. A budget contradicting the strategy fails that outcome.

Source: NIST CSWP 29 (NIST) — Appendix A GV.RR-03

Challenge yourself on this topic → Study as cards