Study. uk . com
  1. Home
  2. All questions
  3. Question 724

CISM study material · question 724 of 1000

How does NIST order policy, plan and procedures for incident response?

  1. Policy and procedures are independent documents
  2. Processes and procedures are based on the incident response policy and plan, rather than standing on their own
  3. Procedures come first and the policy is then written afterwards to reflect what the responders are already doing in practice
  4. Plan and procedures carry equal authority to the policy itself, so any one of the three may override either of the others
Show the answer

Answer: B. Processes and procedures are based on the incident response policy and plan, rather than standing on their own

SP 800-61r3 derives processes and procedures from the incident response policy and plan, so the procedural layer answers to the two documents above it rather than standing alone.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.3 Incident Response Policies

Challenge yourself on this topic → Study as cards