CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
An OT incident response plan is being structured around the NIST SP 800-61 lifecycle. Which sequence correctly orders its phases?
- A.Detection, Preparation, Recovery, Containment, Post-Incident
- B.Containment, Preparation, Detection, Eradication, Recovery, which meets any recovery time objective without spare hardware on site
- C.Preparation; Recovery; Detection; Post-Incident; Containment, which NIST SP 800-82 ranks above network segmentation for protecting control networks
- D.Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity
Why D is correct
NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. OT programs map their procedures onto these phases while layering in safety and process considerations.
Know someone studying for OT Security Fundamentals? Send them this one.