Which set of controls represents core cybersecurity controls commonly found in medium-sized organizations?

• A. Data encryption is optional.
• B. Access control, authentication, authorization, monitoring, backup and recovery, vulnerability management, incident response.
• C. Physical security is sufficient.
• D. Only firewall and antivirus.

Answer: (B)

A solid cybersecurity baseline for a medium-sized organization is a broad, multi-layered set of controls that covers who can access systems, how identities are verified, what those identities can do, and how the organization detects, responds to, and recovers from incidents. This set includes access control, authentication, and authorization to ensure only the right people gain appropriate access; ongoing monitoring to spot unusual or unauthorized activity; backup and recovery to maintain resilience in case of data loss; vulnerability management to keep systems patched against known weaknesses; and incident response to define how to contain and recover from breaches.

This combination is effective because it spans people, processes, and technology, creating defense in depth. If you rely on encryption alone, for example, you still need to control who can reach data, verify identities, monitor systems, and recover if something goes wrong. If you lean on physical security alone, digital threats can bypass it through networks and devices. Limiting protection to just a firewall and antivirus misses critical areas like identity management, patching, data resilience, and formal incident handling.