Study. uk . com
  1. Home
  2. All questions
  3. Question 829

CISM study material · question 829 of 1000

Which three things does an after-action report document, and when is it produced?

  1. What happened, what was done in response and recovery, and what was learned — written as recovery is called finished
  2. The cost, duration and cause of the incident — produced at the next quarterly review
  3. The notification, escalation and closure records for the incident — produced by the compliance function once it has been closed
  4. The threat actor involved, the technique that they used and the target they chose — produced once attribution has been confirmed
Show the answer

Answer: A. What happened, what was done in response and recovery, and what was learned — written as recovery is called finished

SP 800-61r3 pairs the after-action report with the outcome where recovery is declared over and documentation completed, covering the incident, the actions taken and the lessons.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RC.RP-06.R1

Challenge yourself on this topic → Study as cards