Study. uk . com
  1. Home
  2. All questions
  3. Question 779

CISM study material · question 779 of 1000

Which two things does a preliminary triage review establish, according to NIST?

  1. That a cybersecurity incident has actually occurred
  2. The identity of the threat actor held responsible for the activity that was seen
  3. The estimated severity of the incident and the urgency of response
  4. The root cause that lay behind the whole of this one incident
Show the answer

Answer: A. That a cybersecurity incident has actually occurred
C. The estimated severity of the incident and the urgency of response

SP 800-61r3 has the first look at a new report confirm something really did happen, then put a figure on how severe it is and how urgently it needs answering.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MA-02.R1

Challenge yourself on this topic → Study as cards