Under the NIST Cybersecurity Framework (CSF), which activity is classified under the Identify function?

### Why this is right Vendor risk assessment helps the organisation understand and manage risks introduced by suppliers. Supply-chain risk management is explicitly part of the Identify and Manage area. ### The concept Identify and Manage includes understanding assets, the business environment, governance, risk, and the supply chain. A vendor assessment examines whether an external supplier creates risks that need to be accepted, reduced, or avoided. This differs from protective controls that directly safeguard the organisation’s own data and systems. ### The other options - **B. Rehearsing recovery from a ransomware attack**: this primarily tests recovery capability. - **C. Implementing a data loss prevention solution**: this is a protective measure intended to help detect or prevent data loss. - **D. Expanding real-time security monitoring**: this primarily strengthens detection. ### Terms - **Supply-chain risk**: risk arising from suppliers and other external organisations on which a service depends. - **Ransomware**: malicious software that can deny access to data or systems, often by encrypting them. ### Remember Assessing who and what the organisation depends on is part of identifying and managing risk.