BuildSphere Engineering has few sector regulations, but its government contracts require compliance with ITSG-33 (Information Technology Security Guidance 33). What should guide its cybersecurity governance priorities?

### Why this is right BuildSphere's profile says government contracts require compliance with ITSG-33, even though sector-specific regulation is limited. Governance should account for applicable contractual obligations and the risks to sensitive projects. ### The concept Framework selection and compliance planning depend on the organization's actual context. Obligations can arise from contracts as well as laws or sector regulation. A company should identify relevant requirements and connect them to its assets, risks, and governance processes. ### The other options - **B. Only the fact that sector regulation is minimal**: this ignores the stated contract requirement. - **C. The requirements that apply to a different company's industry**: another organization's obligations may not apply to BuildSphere. - **D. A framework chosen without considering contracts or organizational risks**: this removes the contextual analysis needed to select and apply requirements. ### Terms - **ITSG-33 (Information Technology Security Guidance 33)**: The cybersecurity guidance named in BuildSphere's profile as a government-contract requirement. - **Contractual obligation**: A requirement an organization agrees to meet through a contract. ### Remember Check contracts as well as regulations when identifying applicable security requirements.