A municipality invents a unique risk-scoring scheme that external auditors familiar with NIST- and ISO-class approaches cannot map. What should the security program prefer?
Select an answer to reveal the explanation.
Short Explanation
Homegrown score math that nobody outside city hall can read is a translation tax. Lean on NIST/ISO-class patterns so auditors and partners speak the same dialect. Unique can still exist as local flavor—on top of a recognized backbone, not instead of one.
Full Explanation
Recognized risk frameworks (for example NIST, ISO, or COBIT-aligned approaches) provide shared vocabulary, process structure, and auditability. Entirely bespoke scoring that cannot be mapped impedes assurance and peer comparison. Alignment improves consistency of analysis, treatment, and reporting across stakeholders.