Which framework provides guidelines for monitoring and managing IT security risks?

• A. ISO 27001 Framework
• B. COBIT Framework
• C. NIST Cybersecurity Framework
• D. CIS Controls Framework

Answer: (C)

The NIST Cybersecurity Framework is the correct choice because it offers a comprehensive approach for organizations to manage and reduce IT security risks. Developed by the National Institute of Standards and Technology, this framework consists of three main components: the Framework Core, the Framework Implementation Tiers, and the Framework Profile.

The Framework Core contains a set of activities, outcomes, and references that help organizations identify, protect, detect, respond to, and recover from cybersecurity incidents. This structured approach enables organizations to create a customized security strategy tailored to their specific needs and risks, supporting both risk management and compliance efforts.

Moreover, the NIST Cybersecurity Framework is particularly well-regarded for its flexibility, allowing entities to dynamically adjust their cybersecurity practices based on evolving threats and risks, which is critical in today's rapidly changing cyber landscape. Its emphasis on continuous monitoring and improvement makes it a pivotal resource for managing IT security risks effectively.