Which of the following should an organization review to gain a better understanding of the likelihood and impact of cybersecurity events?

Cyber threat information from internal and external sources

Relevant internal or external capability benchmarks

Cybersecurity frameworks, standards, and guidelines

Cyber threat information from internal and external sources

Which of the following is an important consideration when defining the roadmap in COBIT Implementation Phase 3 - Where Do We Want to Be?

Agreed metrics for measuring outcomes

Reporting procedures and requirements

Clear understanding of the likelihood and impact of cybersecurity events

Identification of threats and vulnerabilities related to key assets

Experience in behavioral and change management

Clear understanding of the likelihood and impact of cybersecurity events

Potential benefits of proposed improvements are not considered.

Organizational training on the CSF is not provided.

Potential benefits of proposed improvements are not considered.

The implementation timeline is too long.

Cybersecurity risk management practices are formalized and institutionalized.

Key stakeholders understand the quick wins of the cybersecurity program.

Key stakeholders understand the cybersecurity requirements of the chosen vendors.

Compare current and target profiles.

Report discovered issues to senior management.

Assign mitigating control development.

Compare current and target profiles.

Identify quick wins for implementation first.

Implement organization-wide training on the CSF.

Communicate management opinions regarding the project.

Identify quick wins for implementation first.

The activity of determining an appropriate target capability level for each process occurs within which implementation phase?

Become a Premium Member for full access