What framework aims to provide organizations with improved cybersecurity risk management?

• A. ISO 27001
• B. NIST CSF
• C. COBIT
• D. PCI DSS

Answer: (B)

The NIST Cybersecurity Framework (CSF) is specifically designed to help organizations manage and reduce cybersecurity risk. It provides a flexible and risk-based approach, allowing organizations to prioritize their cybersecurity efforts according to their specific needs and regulatory requirements. The framework is organized into five core functions: Identify, Protect, Detect, Respond, and Recover, which together guide organizations in implementing robust cybersecurity practices.

The NIST CSF emphasizes continuous improvement and adaptability, making it suitable for a wide range of industries and organizational sizes. By aligning with the framework, organizations can establish a common language for managing cybersecurity risks, enabling better communication both internally and with external stakeholders.

While other frameworks, such as ISO 27001 and COBIT, address information security management and governance respectively, they do not focus exclusively on the comprehensive risk management approach that NIST CSF embodies. PCI DSS, on the other hand, is specifically geared towards securing payment card information and is not broadly applicable to overall cybersecurity risk management.