Study. uk . com
  1. Home
  2. All questions
  3. Question 418

CISSP study material · question 418 of 500

A detection rule fires on an adverse cybersecurity event. What does NIST SP 800-61 Rev. 3 say about declaring an incident at that point?

  1. Only events affecting more than one system may be declared incidents.
  2. Additional analysis is usually needed to determine whether an incident has actually occurred.
  3. The event should be declared an incident immediately and downgraded later if needed.
  4. The declaration rests with the authorising official rather than the response team.
Show the answer

Answer: B. Additional analysis is usually needed to determine whether an incident has actually occurred.

SP 800-61r3 states that additional analysis is often needed to determine whether adverse cybersecurity events indicate that a cybersecurity incident has occurred.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > 1. Introduction

Challenge yourself on this topic → Study as cards