What is the PRIMARY purpose of the Recover function in the NIST Cybersecurity Framework?
- A.To develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident
- B.To identify organizational risk tolerances and asset priorities as the GOVERN function alone defines them in its policy documents long before any incident has occurred and any recovery team is assembled
- C.To detect and correlate cybersecurity events across the monitored environment as they happen and to feed alerts into the incident commander's triage queue before any containment decision gets reached
- D.To implement and audit access control rules across each managed endpoint as the sole safeguard that keeps unauthorized entry attempts from reaching the production network and the backup tier
Why A is correct
The Recover function supports timely recovery to normal operations by developing and implementing activities to maintain resilience plans and restore capabilities or services impaired by a cybersecurity incident.
Know someone studying for NIST CSF? Send them this one.