According to the material, which pairing best reflects the resource-based examples for framework selection?

### Why this is right The material gives this pairing as an example of how available funding, staffing, training, and technology resources can influence framework choice. It does not make the examples universal mandates. ### The concept Resource fit is one part of selection. A smaller organization may have fewer staff and less funding than a large enterprise, so the course names CIS Controls or CCCS Baseline Controls as possible choices for a small company. It names NIST CSF and NIST 800-53 as options a large enterprise may adopt. Other factors, including regulations and risk, still matter. ### The other options - **A small company must use NIST 800-53; a large enterprise must use only guidelines.** The material gives different examples and does not state these mandates. - **A small company should ignore its budget; a large enterprise should ignore its maturity.** Budget and maturity are both relevant considerations. - **All organizations should select HIPAA regardless of sector.** Selection depends on the organization's obligations and context; the material identifies HIPAA as a healthcare-related requirement. ### Terms - **National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)**: A named cybersecurity framework in the course material. - **National Institute of Standards and Technology Special Publication 800-53 (NIST 800-53)**: A named publication in the course material. - **Canadian Centre for Cyber Security (CCCS)**: The organization identified by the acronym in CCCS Baseline Controls. ### Remember The examples illustrate resource fit, not mandatory pairings.