CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ40

VerifiedIncident Management

An incident response team recently faced an unfamiliar type of cyber event. Although the team resolved the issue, identifying it required a significant amount of time. What is the BEST way to help ensure that similar incidents are identified more quickly in the future?

Explanation

A post-incident review documents what occurred, assesses the effectiveness of the response, identifies missing indicators or information needed earlier, and defines corrective improvements to detection and handling procedures. NIST incident-response guidance treats lessons learned as a mechanism for improving the handling and detection of future similar incidents.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!