Which framework provides a widely adopted risk management approach for cybersecurity, and what are its five core functions?

• A. NIST Cybersecurity Framework (CSF) with Identify, Protect, Detect, Respond, Recover
• B. ISO/IEC 27001 with Plan-Do-Check-Act
• C. COSO Enterprise Risk Management
• D. PCI Data Security Standard

Answer: (A)

The main idea being tested is a structured, widely used way to manage cybersecurity risk by grouping activities into five functional areas. The framework that fits this description is the one that lays out five functions to organize risk management: Identify, Protect, Detect, Respond, Recover. This framework, the NIST Cybersecurity Framework, helps organizations tailor their risk efforts to their context by guiding them through:

• Identify: understand the organization’s environment, assets, data flows, governance, and risk tolerance. This sets up what needs protection and where risks lie.

• Protect: implement safeguards to reduce the likelihood or impact of a cybersecurity event, such as access controls, awareness training, data security measures, and protective technologies.

• Detect: establish and operate monitoring to spot cybersecurity events promptly, using continuous monitoring, analytics, and detection processes.

• Respond: take appropriate action once an event is detected, including incident response planning, communications, analysis, containment, eradication, and mitigation.

• Recover: restore services and capabilities after an incident and drive improvements to prevent recurrence, through recovery planning, resilience activities, and post-event learning.

Why this one is the best fit: it provides a broad, adaptable risk management approach specifically focused on cybersecurity and organized around these five concrete functions, making it easy to align security activities with risk priorities.

Why the others don’t fit as well: ISO/IEC 27001 is an information security management system standard that uses a Plan-Do-Check-Act cycle for continual improvement, not the five-function risk framework described here. COSO Enterprise Risk Management is a general ERM framework for organizations at large, not specialized for cybersecurity and its five-function structure. PCI DSS is a cardholder data protection standard, focused on specific controls for payment data rather than a comprehensive, five-function risk management framework.