Study. uk . com
  1. Home
  2. All questions
  3. Question 703

CISM study material · question 703 of 1000

An incident is still in recovery and a responder has identified a clear lesson. What does the current NIST guidance advise?

  1. Raise it only if it affects the current recovery
  2. Share the lesson as soon as it is identified rather than holding it until recovery concludes
  3. Wait until the after-action report is drafted
  4. Record it and raise it at the post-incident meeting
Show the answer

Answer: B. Share the lesson as soon as it is identified rather than holding it until recovery concludes

SP 800-61r3 breaks with the old post-incident phase: a lesson is passed on when it is spotted, not banked until recovery is finished.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.1 Incident Response Life Cycle Model

Challenge yourself on this topic → Study as cards