Study. uk . com
  1. Home
  2. All questions
  3. Question 832

CISM study material · question 832 of 1000

Which two things should a public update on incident recovery explain, according to NIST? Choose two.

  1. The steps being taken to recover from the incident
  2. The identity of the threat actor responsible
  3. The financial cost of the incident to date
  4. The steps being taken to prevent a recurrence
Show the answer

Answer: A. The steps being taken to recover from the incident
D. The steps being taken to prevent a recurrence

SP 800-61r3 has a public recovery update, issued under the breach notification procedures, cover both what is being done to recover and what will stop the same thing happening again.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RC.CO-04.R2

Challenge yourself on this topic → Study as cards