Question

Under the NIST Cybersecurity Framework, __________________ of the Risk Management Process indicates risk management practices are approved by management but may not be established as organizational-wide policy.

Answer 1

The 'Informed' tier of the NIST Cybersecurity Framework's Risk Management Process reflects management-approved risk management practices that haven't been formalized as organization-wide policy, suggesting some level of acknowledgement without full standardization.

Step-by-step explanation:

Under the NIST Cybersecurity Framework, the "Informed" tier of the Risk Management Process indicates risk management practices that are approved by management but may not be established as organizational-wide policy. This means that while there is an acknowledgment and approval of the practices and processes to manage cybersecurity risk, they have not necessarily been formalized into the organization's official policies and may not be consistently applied across the entire organization. The NIST Framework's tiered approach helps organizations measure their approach to managing cybersecurity risk and their progress toward their cybersecurity goals.