Which task corresponds to Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional)?

• A. Prepare Tasks (Organization Level)
• B. Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional)
• C. Common Control Identification
• D. Risk Assessment - Organization

Answer: (B)

Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional) is the task that deals with customizing the standard control baselines to fit the organization’s risk posture and mapping them to a CSF profile. In RMF, you start with the predefined baselines (low, moderate, high) and tailor them to reflect what the organization actually needs, including any additional controls or compensating measures. The optional Cybersecurity Framework Profiles let you align these controls with the CSF categories and set a target profile that matches the organization’s risk tolerance and mission requirements.

This task is specifically about organizational-level tailoring, not about preparing governance at the organization level, identifying common controls, or performing risk assessment for the organization. Those other tasks serve different purposes, whereas this one focuses on adjusting the control baseline and aligning with a CSF profile to reflect how the entire organization intends to implement and measure security controls.