A small organization with limited staff and budget is choosing an approach. What principle from the course should guide its decision?

### Why this is right Framework selection is context-dependent. The course specifically includes organizational size, maturity, legal obligations, risks, budget, and staffing among selection considerations. ### The concept A framework should help the organization manage relevant risk and meet its obligations in a way it can implement. A larger or more detailed approach is not automatically better if resources and maturity do not support it. ### The other options - **Adopt the same framework as every large enterprise**: this ignores differences in size, risks, and resources. - **Choose the framework with the largest number of controls, regardless of capacity**: volume alone does not ensure suitability or implementation. - **Avoid considering legal requirements until after implementation**: obligations should inform selection and planning from the outset. ### Remember Fit matters more than choosing a framework simply because it is large or popular.