Study. uk . com
  1. Home
  2. All questions
  3. Question 699

CISM study material · question 699 of 1000

An organisation trained on the earlier NIST incident response guidance is updating to Revision 3. What structural change must it explain to staff?

  1. The four-phase cycle was replaced by a model built on the six CSF 2.0 functions, so preparation is no longer a phase of its own
  2. The four phases were reduced to three by merging containment with recovery, so that eradication now sits inside the recovery phase instead
  3. The model was replaced by a purely technical detection workflow
  4. Preparation was moved to the end of the cycle
Show the answer

Answer: A. The four-phase cycle was replaced by a model built on the six CSF 2.0 functions, so preparation is no longer a phase of its own

SP 800-61r3 replaces the previous four-phase life cycle with a model based on the six CSF 2.0 functions, in which Govern, Identify and Protect are preparation activities outside incident response itself.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.1 Incident Response Life Cycle Model

Challenge yourself on this topic → Study as cards