CRISC · Question #412
An organization recently experienced a cyber attack that resulted in the loss of confidential customer data. Which of the following is the risk practitioner's BEST recommendation after recovery…
The correct answer is B. Perform a root cause analysis. After recovering from a cyber attack and data loss, the most critical step is to perform a root cause analysis to understand why the attack occurred and prevent future incidents.
Question
An organization recently experienced a cyber attack that resulted in the loss of confidential customer data. Which of the following is the risk practitioner's BEST recommendation after recovery steps have been completed?
Options
- ADevelop new key risk indicators (KRIs).
- BPerform a root cause analysis.
- CRecommend the purchase of cyber insurance.
- DReview the incident response plan.
How the community answered
(45 responses)- A20% (9)
- B62% (28)
- C11% (5)
- D7% (3)
Why each option
After recovering from a cyber attack and data loss, the most critical step is to perform a root cause analysis to understand why the attack occurred and prevent future incidents.
Developing new KRIs might be a consequence of lessons learned but is not the immediate best recommendation after an attack.
A root cause analysis (RCA) is essential post-incident to identify the underlying reasons for the failure, enabling the organization to implement corrective actions to prevent recurrence and improve overall security posture. This goes beyond just recovery or reviewing plans by addressing the fundamental issues that led to the breach.
Recommending cyber insurance is a risk transfer strategy and doesn't address the operational or technical failures that led to the incident.
Reviewing the incident response plan is important, but a root cause analysis informs what specific changes are needed to the plan based on actual failures.
Concept tested: Post-incident analysis and improvement
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.