CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
An OT incident response plan is being structured around the NIST SP 800-61 lifecycle. Which sequence correctly orders its phases?
- A.Detection, Preparation, Recovery, Containment, Post-Incident
- B.Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity
- C.Containment, Preparation, Detection, Eradication, Recovery
- D.Preparation; Recovery; Detection; Post-Incident; Containment
Why B is correct
NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. OT programs map their procedures onto these phases while layering in safety and process considerations.
Know someone studying for OT Security Fundamentals? Send them this one.