A small organization has limited security staff and budget. Which approach best reflects sound framework selection?

### Why this is right Framework selection should be based on the organization’s actual circumstances. Size, obligations, risks, staffing, and budget affect which requirements are relevant and achievable. ### The concept A framework organizes security outcomes and practices. It helps an organization assess and communicate its security work, but the organization still has to implement controls and check whether they work. A framework chosen without considering applicable obligations can leave legal or contractual gaps. One chosen without considering resources may be difficult to implement and maintain. ### The other options - **B. Adopt the largest framework available, regardless of its obligations or capacity**: size alone does not determine fit, and an impractical choice may not address the organization’s actual requirements. - **C. Select a framework solely because a competitor uses it**: a competitor may have different obligations, risks, or resources. - **D. Avoid frameworks because they guarantee compliance only for large organizations**: frameworks do not guarantee compliance, and they are not limited to large organizations. ### Terms - **Framework**: An organized set of outcomes or practices used to structure security work. - **Compliance**: Meeting applicable legal, regulatory, contractual, or organizational requirements. ### Remember Select for your organization’s requirements and capacity, not for size or popularity.