Study. uk . com
  1. Home
  2. All questions
  3. Question 705

CISM study material · question 705 of 1000

The former containment, eradication and recovery phase maps onto which CSF functions, and what does that mapping reflect?

  1. Recover alone, since all three restore service
  2. Respond alone, since containment, eradication and recovery are all of them response activities carried out by the same team
  3. Respond and Recover, reflecting that containment and eradication are separate from restoration
  4. Detect and Respond, since containment necessarily follows directly from the detection of the adverse event
Show the answer

Answer: C. Respond and Recover, reflecting that containment and eradication are separate from restoration

SP 800-61r3's mapping shows the containment, eradication and recovery phase corresponding to Respond, Recover and the Improvement category, treating containment and eradication as Respond outcomes distinct from restoration under Recover.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 1 phase mapping

Challenge yourself on this topic → Study as cards