Study. uk . com
  1. Home
  2. All questions
  3. Question 834

CISM study material · question 834 of 1000

An organisation's monitoring surfaces adverse events but nobody can say when one becomes an incident. Which CSF 2.0 prerequisite is missing?

  1. An escalation path running from the analyst who is on duty up to the senior management team that owns the budget for the response
  2. Defined incident criteria against which adverse events are judged so that an incident can be declared
  3. A contract with an external incident response provider that has been retained specifically for that one purpose
  4. A designated incident lead appointed for each one of the adverse events that are raised by the monitoring tools
Show the answer

Answer: B. Defined incident criteria against which adverse events are judged so that an incident can be declared

CSF 2.0 subcategory DE.AE-08 states incidents are declared when adverse events meet the defined incident criteria, which makes those criteria a prerequisite for beginning response.

Source: NIST CSWP 29 (NIST) — Appendix A DE.AE-08

Challenge yourself on this topic → Study as cards