Fire/EMS leadership wants someone who can explain to the board why the department bought Enterprise Security and how the program maps to NIST CSF functions. Which role owns that briefing?
Select an answer to reveal the explanation.
Short Explanation
The board is not Incident Review. Explaining why ES was bought and how it lines up with NIST CSF is Architect talk — program, not a single notable. A CIM extract or a ping does not substitute for that briefing.
Full Explanation
Fire/EMS leadership that needs someone to explain to the board why the department bought Enterprise Security and how the program maps to NIST CSF functions is asking for SOC Architect work. Board-level program communication—business justification and framework mapping—is program design and governance, not a single notable write-up. Civic boards fund SIEM programs when Architects translate capability into public-safety outcomes and control-family language.
Assigning a SOC Analyst fails by concept: a True Positive write-up is evidence of an incident, not a board briefing on why ES was purchased or how NIST CSF functions are covered. Assigning a SOC Engineer fails by concept: a CIM field extraction does not answer program-level buy and map questions. Assigning the on-duty Analyst because an Adaptive Response ping of board laptops "proves the buy" fails by concept: a ping is a technical action, not strategic program communication.
Exam caveat: Audience matters—board and framework-mapping stems point to Architect; queue and Adaptive Response stems point to Analyst; CIM and search stems point to Engineer.
Operational check: Prepare an Architect briefing that ties ES capabilities to Identify/Protect/Detect/Respond/Recover style functions, cites coverage and monitoring outcomes, and leaves notable-level detail in appendices rather than as the main board narrative.