Which outcome corresponds to establishing organizationally-tailored control baselines and Cybersecurity Framework Profiles and making them available?

• A. Missions, business functions, and mission/business processes are identified.
• B. Organizationally-tailored control baselines and Cybersecurity Framework Profiles are established and made available.
• C. The types of information processed, stored, and transmitted by the system are identified.
• D. An organization-wide strategy for monitoring control effectiveness is developed and implemented.

Answer: (B)

Establishing organization-tailored control baselines and Cybersecurity Framework Profiles and making them available is about creating a customized, authoritative set of security controls that fit the organization’s risk tolerance and mission needs, and then distributing that set so everyone involved in implementing and assessing security can use it consistently. The baselines serve as the starting point for selecting and tailoring controls for different systems, while the Profiles capture how those controls are adjusted to address specific risk contexts. Making them available ensures that system owners, assessors, and authorizing officials all reference the same, approved controls, fostering consistency across the enterprise and streamlining the authorization process. Other actions focus on identifying scope (missions and processes), understanding the data handled (types of information), or planning ongoing monitoring, but they don’t address creating and distributing the customized control sets and profiles.