Which term describes the set of practices used to manage risks and protect the confidentiality, integrity, and availability of information, guided by CSF?

Which term describes the set of practices used to manage risks and protect the confidentiality, integrity, and availability of information, guided by CSF?

• A. NIST
• B. Cybersecurity frameworks (CSF)
• C. IAM
• D. Non-repudiation

Answer: (B)

The key idea is a structured collection of practices used to manage cybersecurity risk and protect information. A cybersecurity framework provides this organized set of activities, guiding how an organization protects confidentiality, integrity, and availability of information. It sits at a higher level than individual controls or services, outlining a holistic approach that aligns security work with business risk. The CSF offers a framework with recognizable stages—identify, protect, detect, respond, recover—so organizations can tailor and implement risk-reducing measures across the entire information system. That’s why this term fits: it captures the overall set of practices guided by the CSF, not just a single control area or the publishing body. The other options describe either the organization behind the framework (NIST), a specific domain within security (IAM), or a security service (non-repudiation) rather than the broader, guiding set of practices.

The key idea is a structured collection of practices used to manage cybersecurity risk and protect information. A cybersecurity framework provides this organized set of activities, guiding how an organization protects confidentiality, integrity, and availability of information. It sits at a higher level than individual controls or services, outlining a holistic approach that aligns security work with business risk. The CSF offers a framework with recognizable stages—identify, protect, detect, respond, recover—so organizations can tailor and implement risk-reducing measures across the entire information system. That’s why this term fits: it captures the overall set of practices guided by the CSF, not just a single control area or the publishing body. The other options describe either the organization behind the framework (NIST), a specific domain within security (IAM), or a security service (non-repudiation) rather than the broader, guiding set of practices.