A generic cybersecurity framework may need supplementation to address an enterprise's statutory, regulatory, industry, or regional obligations.

### Why this is right The source warns that generic frameworks may not cover all business, industry, regional, and legal obligations. Enterprises should identify applicable mandatory requirements and integrate them with an industry baseline. ### The concept A framework is a useful starting point, but it is not automatically a complete compliance solution for every organization. For example, a financial institution may have requirements beyond a generic security baseline. The organization must identify which obligations apply to its activities and location. ### The other options - **False**: this would assume that one generic framework always covers every enterprise-specific obligation, which the source explicitly cautions against. ### Terms - **Statutory requirement**: a requirement established by law. - **Regulatory requirement**: a requirement imposed by a regulatory authority. - **Industry baseline**: a general set of security requirements used as a starting point in a sector or across sectors. ### Remember Start with a baseline, then add every applicable obligation.