210-255 · Question #137
What does the CSIRT incident response provider usually do?
The correct answer is F. offer incident handling services as a for-fee service to other organizations. CSIRT types are distinguished by their clientele and purpose; an incident response provider specifically sells commercial incident handling services for a fee to external client organizations.
Question
What does the CSIRT incident response provider usually do?
Options
- Aprovide incident handling services to their parent organization.
- Bprovide incident handling services to a country
- Ccoordinate and facilitate the handling of incidents across various CSIRTs
- Dfocus on synthesizing data from various sources to determine trends and patterns in incident
- Ehandle reports of vulnerabilities in their software or hardware products
- Foffer incident handling services as a for-fee service to other organizations
How the community answered
(28 responses)- C4% (1)
- D7% (2)
- F89% (25)
Why each option
CSIRT types are distinguished by their clientele and purpose; an incident response provider specifically sells commercial incident handling services for a fee to external client organizations.
Providing services exclusively to a parent organization describes an internal CSIRT, not an incident response provider.
Serving an entire country's constituents describes a national CSIRT such as a government-run CERT.
Coordinating and facilitating incident handling across other CSIRTs describes a coordination center, not an incident response provider.
Synthesizing data from multiple sources to identify trends and patterns describes an analysis center CSIRT.
Handling vulnerability reports specific to an organization's own software or hardware products describes a vendor CSIRT or PSIRT.
An incident response provider CSIRT is a commercial entity that packages and sells incident handling as a paid service to client organizations outside its own structure. This distinguishes it from internal, national, or coordination-focused CSIRTs. The for-fee model is the defining characteristic of this CSIRT category.
Concept tested: CSIRT types and their operational roles
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.