Study. uk . com
  1. Home
  2. All questions
  3. Question 744

CISM study material · question 744 of 1000

Which two things does a lessons-learned meeting held as recovery concludes achieve, according to NIST? Choose two.

  1. Going back over the events, the actions taken, and how well those actions worked
  2. Whether to prosecute the attacker
  3. Hearing from all parties involved in the incident
  4. Deciding the organisation's residual risk position
Show the answer

Answer: A. Going back over the events, the actions taken, and how well those actions worked
C. Hearing from all parties involved in the incident

SP 800-61r3 uses the meeting to revisit events, actions and their effectiveness, and to give everyone involved a hearing, so improvements can be identified and ranked.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 2 ID.IM-03.N3

Challenge yourself on this topic → Study as cards