Which term refers to a framework that provides a structured approach to cybersecurity risk management and is widely adopted across industries?

Which term refers to a framework that provides a structured approach to cybersecurity risk management and is widely adopted across industries?

• A. NIST
• B. IAM
• C. Cybersecurity frameworks (CSF)
• D. CIA Triad

Answer: (C)

A framework that structures how an organization manages cybersecurity risk and is used across many industries is described by cybersecurity frameworks. These frameworks provide a repeatable set of activities—often organized into functions like identify, protect, detect, respond, and recover—that help teams assess risk, select appropriate controls, and improve security over time. Because they offer a common language, taxonomy, and a flexible, scalable approach, they’re widely adopted by organizations of all sizes and across sectors. The other terms don’t fit as well. NIST is the organization that develops standards and frameworks, including a well-known cybersecurity framework, but it’s not the framework itself. IAM focuses on managing identities and access rights, not the broader risk-management structure. The CIA Triad refers to fundamental security objectives—confidentiality, integrity, and availability—not a framework for risk management.

A framework that structures how an organization manages cybersecurity risk and is used across many industries is described by cybersecurity frameworks. These frameworks provide a repeatable set of activities—often organized into functions like identify, protect, detect, respond, and recover—that help teams assess risk, select appropriate controls, and improve security over time. Because they offer a common language, taxonomy, and a flexible, scalable approach, they’re widely adopted by organizations of all sizes and across sectors.

The other terms don’t fit as well. NIST is the organization that develops standards and frameworks, including a well-known cybersecurity framework, but it’s not the framework itself. IAM focuses on managing identities and access rights, not the broader risk-management structure. The CIA Triad refers to fundamental security objectives—confidentiality, integrity, and availability—not a framework for risk management.