安全框架(framework)的目的之一是根據安全要求指導控制措施(control)的選擇，以保護資訊系統。 關於安全框架，以下哪項是正確的？ (Wentz QOTD)
A. 框架設定了組織要遵循的標準
B. 框架應盡可能詳盡
C. 框架可能導致強制性實踐
D. 各種框架不應同時採用
One of the security framework’s purposes is to guide the selection of controls based on security requirements to secure information systems. Which of the following is correct about security frameworks? (Wentz QOTD)
A. A framework sets the standard for organizations to follow
B. A framework should be as exhaustive as possible
C. A framework may lead to mandatory practices
D. Various frameworks should not be adopted simultaneously
老師的回覆：
A. A framework sets the standard for organizations to follow => framework是範本/懶人包, 不是標準
B. A framework should be as exhaustive as possible => 應儘量簡單, 易用, 不要太繁索
C. A framework may lead to mandatory practices => framework可能最後會導致/發展出強制性的實務作法
D. Various frameworks should not be adopted simultaneously => 一個組織實際上反而都是導入多個框架, 解決不同需求.
資料來源： Wentz Wu QOTD-20210922
PS:此文章經過作者同意刊登 並且授權可以翻譯成中文
