CRISC Information Technology and Security Practice Question
In the NIST Cybersecurity Framework, which function is primarily focused on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?
⚠ Common exam trap
CRISC often tests the exact CSF function definitions — the trap is confusing Protect (safeguards) with Detect (monitoring) or Identify (asset/risk understanding), since all three sound defensive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Protect
The Protect function in the NIST Cybersecurity Framework (CSF) covers the safeguards that limit or contain the impact of a cybersecurity event — access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is explicitly defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. Detect, Identify, and Recover address different phases of the risk lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detect
Why it's wrong here
Detect covers discovering and analysing cybersecurity events through continuous monitoring, not implementing safeguards. The Protect function delivers the safeguards ensuring critical infrastructure services. Detect tempts because monitoring tools often accompany protective controls, yet detection reacts to incidents rather than preventing them.
- ✓
Protect
Why this is correct
Protect encompasses the safeguards that limit or contain a cybersecurity event's impact, directly satisfying the stem's requirement to ensure delivery of critical infrastructure services. Its categories cover identity management, access control, awareness training, data security, maintenance and protective technology — the controls that actually secure service delivery.
- ✗
Recover
Why it's wrong here
Recover covers restoring capabilities or services impaired by a cybersecurity incident, not deploying safeguards beforehand. Protect develops and implements the appropriate safeguards. Recover tempts because resilience planning and backups feel protective, but those activities occur after an event rather than preventing it.
- ✗
Identify
Why it's wrong here
Identify covers understanding cybersecurity risk to systems, assets, data and capabilities, not implementing safeguards. Protect delivers the safeguards ensuring critical infrastructure services. Identify tempts because asset inventories and risk assessments underpin protection, yet they produce knowledge rather than the protective controls themselves.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.