Study. uk . com
  1. Home
  2. All questions
  3. Question 774

CISM study material · question 774 of 1000

Which activity does NIST describe as perhaps the most critical decision point in the whole incident response process?

  1. Deciding whether to notify law enforcement about what has happened on the organisation's own network
  2. Selecting the containment technique that will be used against this particular kind of incident here
  3. Evaluating the overall risk from an incident and applying the appropriate prioritisation
  4. Choosing the forensic tooling
Show the answer

Answer: C. Evaluating the overall risk from an incident and applying the appropriate prioritisation

SP 800-61r3 singles out judging an incident's overall risk and setting its priority accordingly as arguably where the whole process turns.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MA.N1

Challenge yourself on this topic → Study as cards