Globex Corporation creates, sells, and maintains of digital solutions for customers. It has 16,000 employees spread over 32 geographical locations. The organization has 12,000 company owned devices including desktops, laptops, mobile devices, network devices, third party cloud storage, and other hardware. Globex does not want to permit use of personal devices. The company hosts solutions and sites for clients. It also provides access to internal and third party cloud solutions for clients. The company has an incident response team and recently purchased an IDS and SEIM. It has basic access control and asset inventory system. It has no way of preventing use of personal devices. The company recently suffered a breach and wants to learn from its errors. Risk management policies are in place and have been communicated to employees. The risk executor uses incidents to inform decisions, and meets with the CEO monthly.

Consider the above scenario Identify the tier to which the companies belong. Create a current and target profile for the organization (see NIST Core). Make sure to identify, analyze, and prioritize gaps that you see..