Study. uk . com
  1. Home
  2. All questions
  3. Question 816

CISM study material · question 816 of 1000

An organisation deploys fully automated containment and removes the handlers' ability to intervene. Which NIST recommendation does this breach?

  1. Handlers keep the ability to choose and carry out containment themselves, alongside or instead of the automation
  2. Automated containment must be approved by the authorising official
  3. Automated containment must be tested annually
  4. Automated containment may only be used for malware incidents
Show the answer

Answer: A. Handlers keep the ability to choose and carry out containment themselves, alongside or instead of the automation

SP 800-61r3 wants the manual path preserved: handlers should still be able to pick and run containment actions, whether in place of automated measures or on top of them.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MI-01.R1

Challenge yourself on this topic → Study as cards