Study. uk . com
  1. Home
  2. All questions
  3. Question 19

CompTIA Security+ study material · question 19 of 611

An executive asks why the Cybersecurity Framework does not tell them which products to buy. What is the correct explanation?

  1. The framework describes desired outcomes and deliberately does not prescribe how to achieve them
  2. The framework applies only to critical infrastructure operators
  3. The product list is published separately by the vendor community
  4. Prescriptive guidance is reserved for organisations at the highest Tier
Show the answer

Answer: A. The framework describes desired outcomes and deliberately does not prescribe how to achieve them

Not prescribing implementation is what lets one framework serve organisations of very different size, sector and maturity.

Source: NIST CSWP 29 (NIST) — NIST CSF 2.0 › Abstract

Challenge yourself on this topic → Study as cards