Study. uk . com
  1. Home
  2. All questions
  3. Question 704

CISM study material · question 704 of 1000

In NIST's mapping of the old model to CSF functions, what does the former detection and analysis phase correspond to?

  1. Detect alone
  2. Detect, plus the Improvement category within Identify
  3. Detect and Respond, since analysis leads straight into the response that follows it
  4. Identify and Protect, since analysis rests on knowing the estate and its controls
Show the answer

Answer: B. Detect, plus the Improvement category within Identify

SP 800-61r3's mapping table shows the previous detection and analysis phase corresponding to Detect and to the Improvement category of the Identify function.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 1 phase mapping

Challenge yourself on this topic → Study as cards