Study. uk . com
  1. Home
  2. All questions
  3. Question 770

CISM study material · question 770 of 1000

Which practice does NIST suggest so that response work is tracked from the moment of detection?

  1. Holding a daily review of all alerts raised
  2. Automatically creating and assigning tickets when certain types of alert occur
  3. Escalating every alert to the incident lead
  4. Requiring the analysts to log each alert manually in a shared spreadsheet as it comes in
Show the answer

Answer: B. Automatically creating and assigning tickets when certain types of alert occur

SP 800-61r3 suggests considering automatically creating and assigning tickets in the organisation's ticketing system when certain types of alerts occur.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.AE-06.R3

Challenge yourself on this topic → Study as cards