Study. uk . com
  1. Home
  2. All questions
  3. Question 711

CISM study material · question 711 of 1000

A large organisation operates several incident response teams by geographic segment. What does NIST advise?

  1. Allowing each team full autonomy to suit its region
  2. Binding them into a single coordinated entity so processes, procedures, training and information sharing stay consistent
  3. Rotating staff between teams every quarter
  4. Consolidating all of them into one central team in all cases, so that a single roster covers every geographic segment from one location
Show the answer

Answer: B. Binding them into a single coordinated entity so processes, procedures, training and information sharing stay consistent

SP 800-61r3 states that where multiple teams are used, each responsible for a segment, the teams should be part of a single coordinated entity such as a federation to ensure processes, procedures and training are consistent and information is shared.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.2 Roles and Responsibilities — Incident handlers

Challenge yourself on this topic → Study as cards