Study. uk . com
  1. Home
  2. All questions
  3. Question 836

CISM study material · question 836 of 1000

Which two requirements does CSF 2.0 place on the records of actions taken during an incident investigation? Choose two.

  1. The records are published to all stakeholders
  2. The actions performed are recorded
  3. The integrity and provenance of those records are preserved
  4. The records are destroyed as soon as the incident itself has been closed
Show the answer

Answer: B. The actions performed are recorded
C. The integrity and provenance of those records are preserved

CSF 2.0's RS.AN-06 asks for investigative actions to be written down and for those records to keep their integrity and their provenance — what makes evidence defensible.

Source: NIST CSWP 29 (NIST) — Appendix A RS.AN-06

Challenge yourself on this topic → Study as cards