Study. uk . com
  1. Home
  2. All questions
  3. Question 785

CISM study material · question 785 of 1000

Beyond the incident's characteristics, which factor does NIST say must be weighed in deciding when to begin recovery?

  1. The time elapsed since detection
  2. The availability of the incident lead who has been assigned to this particular incident
  3. The notification deadline that the applicable regulator has imposed on the organisation
  4. The operational disruption the recovery activities themselves will cause
Show the answer

Answer: D. The operational disruption the recovery activities themselves will cause

SP 800-61r3 recommends applying incident recovery criteria to the known and assumed characteristics of the incident, and taking the possible operational disruption of the recovery activities themselves into account, to determine when recovery should be initiated.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MA-05.R2

Challenge yourself on this topic → Study as cards