They have limited budgets and therefore concentrate implementation on controls that mitigate the highest risks is correct. Small nonprofits and early stage firms typically cannot afford to implement the entire NIST SP 800-53 catalog at once and so they prioritize controls that address their most significant risks and exposures.

NIST guidance supports a risk based approach and explicit tailoring of controls so organizations can focus resources where they matter most. Conducting a risk assessment helps pick the controls that reduce the biggest threats first and allows smaller organizations to implement a defensible subset rather than an unprioritized checklist.

Prioritization also lets teams deploy compensating controls and phased implementation plans so security improves iteratively. This approach balances cost, staff capacity, and the need to reduce the highest likelihood or impact scenarios first.

They depend on Google Cloud managed services to handle many security controls is wrong because managed services can reduce some responsibilities but do not remove the organization s obligation to implement many security and compliance controls. The shared responsibility model means the cloud provider and the customer each retain different control responsibilities.

They have abundant staff and can apply every control immediately is wrong because the premise is unrealistic for small nonprofits and early stage firms. Implementing every control immediately requires budget and personnel that these organizations usually do not have.

They assume no compliance requirements apply to them is wrong because many organizations do have legal, contractual, or donor driven obligations and assuming no requirements exist would be an unsafe and rarely accurate justification for skipping controls.

Full AWS Practitioner Certification Question