A company is designing a system of internal controls to ensure the accuracy and reliability of financial reporting, including oversight by management and monitoring of control effectiveness. Which framework would be most appropriate?
COSO — Control Environment & Monitoring Activities
Why:
COSO is the primary framework for internal control over financial reporting (ICFR).
Control Environment → tone at the top
Monitoring → ensuring controls continue to operate effectively
An organization wants to ensure its IT systems align with overall business objectives, while also managing IT risks and performance. Which framework should it use?
COBIT — Governance & Management Objectives
Why:
COBIT focuses on IT governance, making sure IT supports business goals and risks are managed appropriately.
A company is building a cybersecurity program and needs a structured approach to identify threats, protect systems, detect attacks, and recover from incidents. Which framework is most appropriate?
National Institute of Standards and Technology — Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover)
Why:
NIST CSF is designed specifically for managing cybersecurity risk across the full lifecycle.
A company wants to demonstrate to external stakeholders that it follows internationally recognized information security practices and is willing to undergo formal certification. Which framework should it adopt?
International Organization for Standardization 27001 — Information Security Management System (ISMS)
Why:
ISO 27001 provides a formal, certifiable security standard, often used to prove security maturity to customers and regulators.
A company is evaluating whether its IT controls support reliable financial reporting, including access controls and change management. Which framework is most relevant?
COSO — Information & Communication + Control Activities
Why:
Even though IT is involved, the objective is financial reporting reliability, which points to COSO (not COBIT).
COBIT would be used if the focus were broader IT governance.
An organization wants a flexible framework to improve its cybersecurity posture internally, without needing formal certification. Which should it use?
National Institute of Standards and Technology — Cybersecurity Framework
Why:
NIST is guidance-based and flexible, unlike ISO which is formal and certifiable.
A service organization wants to provide ongoing assurance to customers about internal controls over time, but not necessarily obtain a formal certification. What should it use?
SOC 2 Type 2 (not ISO)
Why:
ISO = certification
SOC 2 = assurance report over controls
This distinction shows up often in ISC sims.
Management is emphasizing ethical behavior, integrity, and accountability across the organization. Which framework component does this relate to?
COSO — Control Environment
Why:
Control Environment = tone at the top, ethics, governance foundation.
A company wants a prioritized, practical checklist of specific security actions (e.g., inventory devices, control admin privileges, continuous vulnerability management) to quickly improve its cybersecurity posture. Which framework is most appropriate?
Center for Internet Security Controls
Why:
CIS Controls are:
Action-oriented
Prioritized (18 controls)
Designed for implementation, not just guidance
Think:
👉 “What should we do first to be secure?”
A federal contractor must implement detailed, specific security controls to comply with government requirements, including access control policies, audit logging, and system integrity controls. Which framework should be used?
National Institute of Standards and Technology SP 800-53 — Security Control Catalog
Why:
NIST SP 800-53 provides:
Detailed control requirements
Used heavily by government and regulated entities
Much more granular than NIST CSF
An organization wants a high-level framework to organize its cybersecurity program, but does not need detailed control specifications. Which should it use?
National Institute of Standards and Technology Cybersecurity Framework (CSF)
Why:
NIST CSF = high-level structure (Identify–Protect–Detect–Respond–Recover)
NIST SP 800-53 = detailed control list
A small-to-midsize company wants a simple, prioritized set of cybersecurity actions rather than a comprehensive framework. Which is best?
Center for Internet Security Controls
Why:
CIS is:
Simpler than NIST
More practical and implementation-focused
Designed for quick adoption
A company is concerned that its IT function is not aligned with business strategy, and leadership wants stronger governance over IT decisions. Which framework should be implemented?
COBIT — Governance Objectives
Why:
COBIT = IT governance and alignment
NIST = security, not governance
An organization wants to obtain formal certification for its information security program rather than just implement detailed controls. Which should it choose?
International Organization for Standardization 27001 — ISMS
Why:
ISO = certification
NIST SP 800-53 = control catalog (no certification)
An auditor notes that a company:
Maintains an inventory of authorized devices
Controls use of administrative privileges
Continuously monitors vulnerabilities
Which framework are these controls most closely associated with?
Center for Internet Security Controls
Why:
These are signature CIS controls—very practical, specific security actions.
Center for Internet Security Controls
Why:
These are signature CIS controls—very practical, specific security actions.
National Institute of Standards and Technology SP 800-53
Why:
Those two-letter control families are a hallmark of NIST SP 800-53.
A company wants a framework to ensure internal controls over financial reporting are properly designed and monitored.
COSO
Why:
COSO is the primary framework for internal control over financial reporting (ICFR)—it covers design, implementation, and monitoring of controls.
An organization needs a structured approach to identify, detect, respond to, and recover from cyber threats.
National Institute of Standards and Technology Cybersecurity Framework
Why:
This is literally the NIST CSF lifecycle: Identify → Protect → Detect → Respond → Recover.
A company wants a prioritized list of specific security actions like controlling admin privileges and inventorying devices.v
A company wants a prioritized list of specific security actions like controlling admin privileges and inventorying devices.
A federal contractor must implement detailed, categorized security controls such as AC (Access Control) and AU (Audit & Accountability).
National Institute of Standards and Technology SP 800-53
Why:
NIST SP 800-53 is a detailed control catalog, commonly required for government and regulated environments.
Management wants to ensure IT strategy aligns with business objectives and risk management goals.
COBIT
Why:
COBIT focuses on IT governance, ensuring IT supports business strategy and manages risk.
An organization wants a flexible cybersecurity framework but does NOT need detailed control requirements.
National Institute of Standards and Technology Cybersecurity Framework
Why:
NIST CSF is high-level and flexible, unlike SP 800-53 which is highly detailed.
A company wants to demonstrate to customers that it meets internationally recognized security standards and obtain certification.
International Organization for Standardization 27001
Why:
ISO 27001 is a formal, certifiable information security standard used for external credibility.
A company is implementing controls to ensure ethical behavior, strong governance, and tone at the top.
COSO — Control Environment
Why:
The Control Environment component of COSO focuses on ethics, integrity, and governance culture.
-
Final Review - Weak Areas42
-
COSO ERM12
-
COSO ERM for Cloud Computing19
-
COSO ERM (+Cloud Computing)13
-
NIST PF Rapid Fire20
-
NIST SPF 800-398
-
COBIT Domains40
-
COBIT Design Factors Rapid Fire25
-
COBIT Framework25
-
Threats and Attacks Rapid Fire78
-
Information Systems Rapid Fire37
-
Network Security Definitions62
-
Trust Services Rapid Fire27
-
Network Infrastructure Definitions29
-
Cloud Services Definitions19
-
Data & Analytics18
-
SOC Controls2
-
SOC Reporting10
-
Safeguards8
-
Change Management31
-
Open Systems Interconnection (OSI)30
-
Frameworks9
-
Business Resiliency9
-
General Controls Definitions14
-
Framework Identification45
-
Disaster Recovery Plan11
-
COSO4
-
COSO IF Rapid Fire20
-
PCI DSS7
-
GDPR Drills12
-
CIS Rapid Fire54
-
Center for Internet Security (CIS) Rapid Fire55
-
CIS Simplified8
-
COBIT Very Simple5
-
COBIT Framework/System Principles20
-
COBIT Design Factors23
-
NIST CSF Rapid Fire20
-
NIST Very Simple5
-
Resiliency, Continuity, and Recovery9
-
Business Impact Analysis (BIA)15
-
Incident Response Plan (IRP)16
-
BIA & IRP Metrics22
-
NIST CSF + PF Table35
