NISTNIST CSFRespond FunctionEASYFree question
What type of information should be shared with external stakeholders during a cybersecurity incident?
- A.No detail should ever be shared externally, regardless of legal, regulatory, and business considerations
- B.Financial estimates, headcount changes, and vendor names, kept apart from any other record or shared file
- C.Full technical detail of the breach, including credentials and passwords
- D.Information consistent with response plans, legal requirements, and organizational policies
Why D is correct
Information shared externally should be consistent with response plans, legal and regulatory requirements, and organizational policies to ensure appropriate disclosure without compromising the investigation.
Know someone studying for NIST CSF? Send them this one.