ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The NIST Cybersecurity Framework (CSF) is a voluntary guidance document whose core consists of the five functions Identify, Protect, Detect, Respond, and Recover. Each function is further divided into categories, subcategories, and informative references that point to other standards and best practices. The NIST Risk Management Framework (RMF) is a mandatory seven-step process for U.S. federal systems; it is not organized by the five functions. COBIT focuses on overall IT governance and management objectives, while ISO/IEC 27001 defines requirements for an information security management system-neither uses the five-function structure described in the scenario.