Discuss Isaca NIST-COBIT-2019 Exam Topic 3 Question 9

Which of the following is MOST likely to cause an organization's NIST Cybersecurity Framework (CSF) implementation to fail?

AOrganizational training on the CSF is not provided.

BPotential benefits of proposed improvements are not considered.

CThe implementation timeline is too long.

Suggested Answer: B

One of the most likely causes of an organization's NIST CSF implementation failure is that the potential benefits of proposed improvements are not considered, which means that the organization does not conduct a cost-benefit analysis of the solutions to address the gaps between the current and target profiles. This can result in a lack of justification, prioritization, and alignment of the implementation plan with the organization's mission drivers, risk appetite, and resource constraints12.

Reference 7 Steps to Implement & Improve Cybersecurity with NIST 3 Security Issues Overlooked By the NIST Framework

Get Premium NIST-COBIT-2019 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

36 comments · newest first

Charlie 10 months ago

I’m surprised this is even a question. Training is a must for success!

Selma 11 months ago

Wait, are we really saying training isn't important? That seems off.

Pamela 11 months ago

C could be a problem too, but I feel like it's manageable with good planning.

Leah 11 months ago

I think B is more critical. If you don't see the benefits, why bother?

Carisa 11 months ago

A is definitely a big issue. Without training, how can anyone implement it?

Kirk 12 months ago

I feel like if the organization doesn’t train its staff, it could lead to a lot of confusion and ultimately failure. That seems like the most likely cause.

Letha 12 months ago

I practiced a similar question, and I think the timeline might not be as critical as the training aspect. But I could be wrong.

Alayna 12 months ago

I’m not entirely sure, but I think considering the benefits of improvements is crucial too. Maybe that could lead to failure if overlooked?

Willodean 1 year ago

I remember we discussed how lack of training could really hinder the CSF implementation. It seems like a major factor.

Lakeesha 1 year ago

I'm a little confused by this question. All of the options seem plausible to me. I'll need to review the NIST CSF requirements more closely to figure out which one is truly the most likely cause of failure.

Dominga 1 year ago

I've got a good feeling about this one. The timeline being too long seems like it could be the most likely culprit. Dragging out the implementation process can really undermine the whole effort.

Jovita 1 year ago

Okay, let's see. I think the key here is to consider what's most critical for a successful NIST CSF implementation. Lack of training and not considering potential benefits both seem like they could be major issues.

Meaghan 1 year ago

Hmm, I'm a bit unsure about this one. The options seem pretty similar, so I'll need to really think through the nuances of each to determine the most likely cause of failure.

Lynna 1 year ago

This seems like a pretty straightforward question. I'd focus on understanding the key factors that can lead to a failed NIST CSF implementation.

Janet 2 years ago

I dunno, I just hope the NIST folks don't try to make us wear funny hats or something during the implementation. That would be a real dealbreaker.

Mammie 2 years ago

↳ replying to Janet

B) Potential benefits of proposed improvements are not considered.

Burma 2 years ago

↳ replying to Janet

A) Organizational training on the CSF is not provided.

Stephaine 2 years ago

Hah, I bet the real reason it fails is because the IT guy got distracted by the latest video game release. Gotta keep those priorities straight!

Leota 2 years ago

↳ replying to Stephaine

Hah, I bet the real reason it fails is because the IT guy got distracted by the latest video game release. Gotta keep those priorities straight!

Jose 2 years ago

↳ replying to Stephaine

C) The implementation timeline is too long.

Mozell 2 years ago

↳ replying to Stephaine

B) Potential benefits of proposed improvements are not considered.

Wendell 2 years ago

↳ replying to Stephaine

A) Organizational training on the CSF is not provided.

Leeann 2 years ago

Not considering the potential benefits? That's just bad business sense. How are we supposed to get buy-in without that?

Elmira 2 years ago

↳ replying to Leeann

We need to make sure everyone sees the value in implementing the CSF.

Sonia 2 years ago

↳ replying to Leeann

I agree, not considering the potential benefits is a big mistake.

Kenneth 2 years ago

↳ replying to Leeann

C) The implementation timeline is too long.

Rozella 2 years ago

↳ replying to Leeann

B) Potential benefits of proposed improvements are not considered.

Michal 2 years ago

↳ replying to Leeann

A) Organizational training on the CSF is not provided.

Gussie 2 years ago

I believe the implementation timeline being too long could also lead to failure. It may result in delays and loss of momentum.

Juliana 2 years ago

I agree with Shanda. Without proper training, employees may not understand how to effectively implement the framework.

Shanda 2 years ago

I think not providing organizational training on the CSF could cause the implementation to fail.

Ressie 2 years ago

The timeline being too long is a recipe for failure. Cybersecurity moves fast, and we need to keep up the momentum.

Shoshana 2 years ago

I think the lack of organizational training on the CSF is the biggest issue. How can we expect people to implement something they don't understand?

Samuel 2 years ago

↳ replying to Shoshana

B) Potential benefits of proposed improvements are not considered.

Rasheeda 2 years ago

↳ replying to Shoshana

I agree, without proper training, it's hard for people to know how to implement the CSF.

Hillary 2 years ago

↳ replying to Shoshana

A) Organizational training on the CSF is not provided.

Isaca NIST-COBIT-2019 Exam - Topic 3 Question 9 Discussion