Study. uk . com
  1. Home
  2. All questions
  3. Question 499

CompTIA Security+ study material · question 499 of 611

An organisation handles a major incident well but never holds a review afterwards. What has it lost?

  1. The value the incident could have produced through lessons learned
  2. The chain of custody for the evidence
  3. Compliance with the notification deadline
  4. The ability to close the incident record
Show the answer

Answer: A. The value the incident could have produced through lessons learned

Without the review the organisation pays the cost of the incident without gaining the improvement.

Source: NIST SP 800-61 Rev. 2 (NIST) — SP 800-61 Rev. 2 § 3.4.1 Lessons Learned

Challenge yourself on this topic → Study as cards