A company plans rapid cloud adoption, has a remote workforce, holds customer information and intellectual property, and has limited security staffing. Explain which selection factors an assessor should investigate before recommending a framework.

### What a good answer covers - Investigate business objectives, including cloud adoption and remote work. - Identify critical assets, including customer information and intellectual property, and determine likely threats. - Establish applicable legal and regulatory requirements and the organization's risk tolerance. - Assess current security maturity, staffing, budget, training, and technology resources. - Consider cloud governance and Zero Trust principles while recommending an approach the organization can support. ### The concept The scenario combines several selection factors from the course material. Business plans can change the security emphasis an organization needs. Critical assets help identify what must be protected, while threat assessment helps identify likely harm. Regulations and risk tolerance constrain acceptable choices. Current maturity and resources determine whether the organization can implement and manage its chosen approach. A framework recommendation should connect all these facts rather than focus on cloud adoption alone. ### Terms - **Intellectual property**: Information or creations that have value to an organization. - **Risk tolerance**: The amount or type of risk an organization is willing to accept. - **Cloud governance**: Organizational direction and management of cloud use. - **Zero Trust**: A security principle the material identifies as a possible framework emphasis. ### Remember A good recommendation fits both the organization's future plans and its present capacity.