In the case study, what is the main purpose of defining the assessment scope?

### Why this is right Scope sets the boundaries of the evaluation. The case says the in-scope services, facilities, applications, systems, people, and processes are specifically defined. ### The concept A bounded scope tells assessors what to examine and helps readers understand which parts of the organization the findings cover. It does not imply that out-of-scope areas are secure. ### The other options - **To guarantee that the organization will have no cybersecurity incidents**: an assessment informs risk decisions but cannot guarantee prevention. - **To select a single technology that must be used throughout the organization**: the case evaluates outcomes and practices, not one mandatory product. - **To replace the organization’s risk management process**: a framework complements, rather than replaces, that process. ### Terms - **NIST CSF**: National Institute of Standards and Technology Cybersecurity Framework. A framework for communicating and managing cybersecurity risk. ### Remember Treat assessment conclusions as applying to the stated scope, not automatically to the entire organization.