Study. uk . com
  1. Home
  2. All questions
  3. Question 802

CISM study material · question 802 of 1000

Which two things should established incident coordination procedures state? Choose two.

  1. At what times reporting occurs, covering both initial notification and regular status updates
  2. What must be reported and to whom
  3. The retention period that applies to each one of the reports produced during the whole course of the response
  4. The technical format in which each of the reports has to be produced
Show the answer

Answer: B. What must be reported and to whom
A. At what times reporting occurs, covering both initial notification and regular status updates

SP 800-61r3 has coordination procedures fix both the content and the timing: who receives what, and when — the first notification and the status updates that follow.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.CO-02.R2

Challenge yourself on this topic → Study as cards