NISTNIST CSFRespond FunctionEASYFree question
What type of information should be shared with external stakeholders during a cybersecurity incident?
- A.All technical details of the breach including system passwords
- B.Information consistent with response plans, legal requirements, and organizational policies
- C.No information should ever be shared externally
- D.Only financial impact estimates
Why B is correct
Information shared externally should be consistent with response plans, legal and regulatory requirements, and organizational policies to ensure appropriate disclosure without compromising the investigation.
Know someone studying for NIST CSF? Send them this one.