Study. uk . com
  1. Home
  2. All questions
  3. Question 819

CISM study material · question 819 of 1000

Which three things does NIST say personnel do during incident recovery?

  1. Notify, escalate and report the incident
  2. Restore systems to normal operations, confirm they are functioning normally, and where applicable remediate vulnerabilities to prevent similar incidents
  3. Detect, analyse and declare the incident
  4. Contain the incident, eradicate the attacker's presence from every one of the affected systems, and then document everything that was done throughout the response
Show the answer

Answer: B. Restore systems to normal operations, confirm they are functioning normally, and where applicable remediate vulnerabilities to prevent similar incidents

SP 800-61r3 has recovery put systems back into normal service, check they really are working properly, and — where it applies — close the weaknesses that let the incident happen.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RC.N1

Challenge yourself on this topic → Study as cards