NIST-COBIT-2019 Practice Questions

According to the NIST Cybersecurity Framework, gaps identified between the current and target

profiles should be addressed through a risk-based approach, which enables an organization to gauge

the resources needed and prioritize the mitigation of gaps in a cost-effective manner. This approach

also aligns the cybersecurity program with the business objectives and risk appetite of the

organization12.

Reference

Examples of Framework Profiles | NIST

What is the NIST Cybersecurity Framework? | IBM

Combining CSF principles with COBIT 2019 practices helps to ensure value, manage risk, and support

mission drivers through support and direction of the board of directors and executive management,

as they are responsible for setting the vision, strategy, and objectives of the organization, and for

overseeing the governance and management of IT-related operations12.

Reference

Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA

COBIT 2019 (With Principles, Components, Users and Benefits)

Thank you for your visit.

A CSF Informative Reference within the CSF Core provides a citation to a related activity from

another standard or guideline that can help an organization achieve the outcome described in a CSF

Subcategory12. For example, the Informative Reference for ID.AM-1 (Physical devices and systems

within the organization are inventoried) is COBIT 5 APO01.01, which states "Maintain an inventory of

IT assets"3.

Reference: 1: Informative Reference: What are they, and how are they used? | NIST 2: Everything to

Know About NIST CSF Informative Reference | Axio 3: NIST Cybersecurity Framework v1.1 - CSF Tools

- Identity Digital

This COBIT task and activity corresponds to CSF Step 1: Prioritize and Scope, because it involves

assessing the current state of the enterprise’s governance and management system, as well as its

readiness and ability to adopt changes12. This task and activity is part of the COBIT 2019

implementation phase "Where are we now?"3, which aligns with the CSF step of identifying the

business drivers, mission, objectives, and risk appetite of the organization4.

Reference: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA 3:

Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA 4: Cybersecurity Framework

Components | NIST

According to the ISACA guide, the order of these two steps may be reversed depending on the

culture of the organization and the level of stakeholder engagement1. Some organizations may

prefer to start with a broad orientation of the NIST CSF and COBIT 2019 before scoping and

prioritizing the implementation, while others may want to define the scope and priorities first and

then orient the stakeholders accordingly.

Reference

Implementing the NIST Cybersecurity Framework Using COBIT 2019, page 17.

The CSF Implementation Tiers distinguish three fundamental dimensions of risk management to help

enterprises evaluate their cybersecurity posture, which is the alignment of their cybersecurity

activities and outcomes with their business objectives and risk appetite12. The Tiers range from

Partial (Tier 1) to Adaptive (Tier 4) and describe the degree of rigor, integration, and collaboration of

the organization’s cybersecurity risk management practices12.

Reference: 1: Cybersecurity Framework Components | NIST 2: Cybersecurity Framework FAQs

Framework Components | NIST

According to the ISACA guide, monitoring performance against objectives is one of the tasks

associated with realizing benefits, as it helps to measure the outcomes and value of the CSF

implementation, and to identify and address any issues or gaps that may arise1. This task also

involves reporting and communicating the results and feedback to the relevant stakeholders and

ensuring continuous improvement2.

Reference

Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA

Manage Enterprise Cyberrisk by Applying the NIST CSF With COBIT … - ISACA

The primary reason for establishing open communication between all participants and stakeholders

as part of the implementation phase is to ensure issues can be identified and resolved, as this can

facilitate the collaboration, coordination, and feedback among the involved parties, and help to

overcome the challenges and risks that may arise during the implementation12.

Reference

Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA

Questions and Answers | NIST

This is an objective of COBIT Implementation Phase 3: Where Do We Want to Be?, because it

involves defining the desired state of the enterprise’s governance and management system, based

on the stakeholder needs, drivers, and scope12. This objective also includes using the COBIT

Performance Management system to assess the current and target capability levels of the processes

that support the governance and management objectives34.

Reference: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA 3: COBIT

2019 Performance Management: Principles and Processes 4: Effective Capability and Maturity

Assessment Using COBIT 2019 - ISACA

The Identify function provides foundational activities for the effective use of the Cybersecurity

Framework, because it assists in developing an organizational understanding of managing

cybersecurity risk to systems, people, assets, data, and capabilities12. This understanding enables an

organization to focus and prioritize its efforts, consistent with its risk management strategy and

business needs12. The Identify function includes outcome categories such as Asset Management,

Business Environment, Governance, Risk Assessment, Risk Management Strategy, and Supply Chain

Risk Management12.

Reference: 1: The Five Functions | NIST 2: Getting Started with the NIST Cybersecurity Framework: A

Quick Start Guide