A management team reviews its cybersecurity by asking: How well does our capability match current threats? What are our important assets? How do risks affect our goals? How do we manage threats and attackers? Are we compliant? How do we compare with others? What incidents occurred, what caused them, what did we do, and are we improving? Explain how these questions support cybersecurity management.

### Why this is right The questions cover the management responsibilities listed in the material: understanding threats and assets, connecting risk to goals, assessing controls and compliance, learning from incidents, and tracking change over time. They make cybersecurity a continuing management review rather than a one-time technical check. ### The concept Managers use these questions to decide whether resources and security capability match the organization's operating environment. Reviewing incidents helps identify causes and evaluate whether corrective actions were taken. Comparisons with others can provide context for security levels and investment, while compliance checks identify obligations that must be met. ### What a good answer covers - Assess capability against current threats and operating conditions. - Identify important assets and business goals affected by risk. - Review risk management, attackers, standards, and regulations. - Examine incidents, their causes, and actions taken. - Track whether security and risk management are improving or worsening. ### Terms - **Asset**: Something valuable to an organization that requires protection. - **Attacker**: A person or group attempting to compromise systems or information. - **Risk management**: Organizational work to assess and address risks. ### Remember Good management asks about capability, business impact, compliance, incidents, and progress.