Fire/EMS leadership wants someone who can explain to the board why the department bought Enterprise Security and how the program maps to NIST CSF functions. Which role owns that briefing?
Select an answer to reveal the explanation.
Short Explanation
The board is not Incident Review. Explaining why ES was bought and how it lines up with NIST CSF is Architect talk — program, not a single notable. A CIM extract or a ping does not substitute for that briefing.
Full Explanation
Architects communicate SIEM program purpose and how it maps to industry functions such as the NIST Cybersecurity Framework. A notable write-up, even a true positive, is an operational artifact, not a board-level program brief. CIM extractions and Adaptive Response actions are Engineer or Analyst tools; they do not explain why the department purchased Enterprise Security. SPLK-5001 treats that leadership communication as Architect work.