A manager asks whether the organization's security capability matches the current threat situation. What is the manager primarily assessing?

### Why this is right The management questions in the material ask how well organizational capability matches the current threat situation in the operating environment. This is an assessment of security capability in context. ### The concept Cybersecurity capability should be judged against the threats an organization faces, its important assets, and its business goals. A capability that is adequate in one environment may be insufficient in another. Managers need qualified input and evidence from incidents and assessments to make this judgment. ### The other options - **B. Whether every employee has identical system privileges**: The course calls for minimum access and role-based privileges, not identical access for everyone. - **C. Whether cybersecurity can be delegated entirely to vendors**: Management remains responsible for understanding organizational risks and decisions. - **D. Whether all previous incidents were harmless**: Managers should review incidents and causes, but the question concerns capability compared with current threats. ### Terms - **Capability**: The organization's ability and resources to perform a security task. - **Threat situation**: The set of relevant threats and conditions facing an organization. ### Remember Judge security capability against the organization's actual threat environment.