Study. uk . com
  1. Home
  2. All questions
  3. Question 839

CISM study material · question 839 of 1000

Which two things does CSF 2.0 require when incident recovery ends? Choose two.

  1. The response team is formally disbanded
  2. The systems are recategorised
  3. Incident-related documentation is completed
  4. The end of recovery is declared based on defined criteria
Show the answer

Answer: D. The end of recovery is declared based on defined criteria
C. Incident-related documentation is completed

CSF 2.0's RC.RP-06 has recovery end against stated criteria, with the incident's documentation finished at the same point.

Source: NIST CSWP 29 (NIST) — Appendix A RC.RP-06

Challenge yourself on this topic → Study as cards