Study. uk . com
  1. Home
  2. All questions
  3. Question 706

CISM study material · question 706 of 1000

Where do lessons from all six CSF functions go in the SP 800-61r3 model, and what happens to them?

  1. Into the Improvement category within Identify, where they are analysed and prioritised to inform all six functions
  2. Into the Govern function, where policy is amended
  3. Into the Respond function, where procedures are updated
  4. Into the after-action report, where they are archived
Show the answer

Answer: A. Into the Improvement category within Identify, where they are analysed and prioritised to inform all six functions

SP 800-61r3 routes lessons from every function into Improvement, inside Identify, where they are analysed, ranked and sent back out to shape all six functions.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.1 Incident Response Life Cycle Model

Challenge yourself on this topic → Study as cards