Which statement best captures the course material's guidance on choosing a cybersecurity framework?

### Why this is right The course material says framework selection is not a one-size-fits-all decision. Business context, risk profile, applicable regulations, and available resources all affect suitability. ### The concept Selection should reflect the organization's actual operating conditions. Industry, size, geographic locations, workforce, and information technology maturity help describe the organization. Legal obligations, business objectives, critical assets, threats, current security maturity, budget, and staffing provide further context. A framework should be relevant to risk and feasible to implement. ### The other options - **Use the same framework in every organization because security needs are identical.** This contradicts the stated context-dependent approach. - **Choose only by organization size, without considering other factors.** Size matters, but it is one input among several. - **Choose whichever framework requires the fewest security activities.** Minimal effort alone does not show that the framework fits the organization's obligations or risks. ### Terms - **Risk profile**: The organization's pattern and level of cybersecurity risks. - **Regulatory requirement**: A legal or sector obligation an organization must address. ### Remember Choose for organizational fit, not by a single feature.