What does the Improvements category (RC.IM) within the CSF 1.1 Recover function address?
- A.Assigning new physical security hardware and updated access badges once the incident response phase formally closes for the affected building
- B.Tracking incident response costs and vendor invoices for the finance team and reconciling them against the quarterly budget forecast
- C.Incorporating lessons learned into future recovery planning and updating recovery strategies based on experience
- D.Cataloging newly acquired assets and updating the master inventory list with purchase dates and warranty terms kept by the procurement team
Why C is correct
Improvements (RC.IM) ensures that recovery planning and processes are improved by incorporating lessons learned from current and previous recovery activities into future plans.
Know someone studying for NIST CSF? Send them this one.