An organization may need to combine a general cybersecurity framework with sector-specific or legal requirements.

### Why this is right A general framework may help structure risk management, but it may not cover every legal, contractual, or sector-specific obligation. Organizations need to identify and address the requirements that actually apply. ### The concept A framework can provide a shared structure for security practices. Sector requirements add expectations for particular environments, such as payment processing, health care, defense, or energy. Laws and regulations impose duties within their scope. Mapping these sources to policies and controls helps reveal overlaps and gaps. ### The other options - **False**: this would incorrectly assume that a general framework automatically includes every requirement relevant to every organization. ### Terms - **Sector-specific requirement**: A security or compliance requirement directed at a particular industry. - **Control**: A safeguard or activity used to address risk or meet an obligation. ### Remember A general framework can be a foundation, but check for additional requirements.