Study. uk . com
  1. Home
  2. All questions
  3. Question 413

CISSP study material · question 413 of 500

A team holds every lesson learned until a formal review three months after recovery completes. What does NIST SP 800-61 Rev. 3 recommend?

  1. Hold lessons until recovery ends, so the picture is complete before conclusions are drawn.
  2. Defer lessons to the annual risk assessment, where they can be weighed against other findings.
  3. Share lessons as soon as they are identified rather than waiting until recovery has concluded.
  4. Record lessons but share them only with the incident response team.
Show the answer

Answer: C. Share lessons as soon as they are identified rather than waiting until recovery has concluded.

SP 800-61r3 says lessons learned during incident response should often be shared as soon as they are identified, not delayed until after recovery concludes.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > 2.1 Incident Response Life Cycle Model

Challenge yourself on this topic → Study as cards