Standards, best practices, and guidelines for effective security risk management; some general and some industry-specific.

Standards, best practices, and guidelines for effective security risk management; some general and some industry-specific.

• A. Security controls
• B. Cybersecurity frameworks (CSF)
• C. Gap analysis
• D. Identity and access management (IAM)

Answer: (B)

Cybersecurity frameworks provide a structured set of standards, guidelines, and best practices for managing security risk across an organization. They bring together general principles and industry-specific requirements into a cohesive program, so you can identify risks, select appropriate controls, implement them, and continually improve your security posture. This is the best fit because frameworks establish a common language and a repeatable process for risk management. They often outline a lifecycle—identify, protect, detect, respond, and recover—and mapping activities helps align governance, risk assessment, and controls with business goals. They also help organizations benchmark against recognized practices and tailor their approach to industry needs (for example, general frameworks like NIST CSF or ISO 27001, and industry-specific ones like PCI DSS or HIPAA). Security controls, while essential, are individual measures rather than a complete system for managing risk. Gap analysis is a method for comparing current and desired states, not a full framework for ongoing risk management. IAM focuses on who can access what, a critical area but narrower in scope than a full risk-management framework.

Cybersecurity frameworks provide a structured set of standards, guidelines, and best practices for managing security risk across an organization. They bring together general principles and industry-specific requirements into a cohesive program, so you can identify risks, select appropriate controls, implement them, and continually improve your security posture.

This is the best fit because frameworks establish a common language and a repeatable process for risk management. They often outline a lifecycle—identify, protect, detect, respond, and recover—and mapping activities helps align governance, risk assessment, and controls with business goals. They also help organizations benchmark against recognized practices and tailor their approach to industry needs (for example, general frameworks like NIST CSF or ISO 27001, and industry-specific ones like PCI DSS or HIPAA).

Security controls, while essential, are individual measures rather than a complete system for managing risk. Gap analysis is a method for comparing current and desired states, not a full framework for ongoing risk management. IAM focuses on who can access what, a critical area but narrower in scope than a full risk-management framework.