GCIH · Question #468
How can you minimize your chances of a mistake, such as not notifying a required party, being made during an incident response?
The correct answer is C. Have proper procedures in place. Documented procedures reduce human error during incident response by providing step-by-step guidance that ensures no required action or notification is overlooked.
Question
How can you minimize your chances of a mistake, such as not notifying a required party, being made during an incident response?
Options
- AHave management support
- BHave administrative access to all systems
- CHave proper procedures in place
- DFill out chain of custody forms promptly
How the community answered
(22 responses)- A5% (1)
- B5% (1)
- C91% (20)
Why each option
Documented procedures reduce human error during incident response by providing step-by-step guidance that ensures no required action or notification is overlooked.
Management support is important culturally but does not directly prevent procedural mistakes like missing a required notification during an active incident.
Administrative access enables responders to act on systems but does not guide them on what steps to take or who to notify.
Proper procedures - such as incident response playbooks or runbooks - define every required action, notification, and escalation path in advance. This removes reliance on memory under stress, ensuring that required parties are always notified and steps are not skipped. Without documented procedures, even experienced responders can omit critical steps during high-pressure incidents.
Chain of custody forms are relevant to evidence handling in forensic investigations, not to preventing notification or response mistakes during the broader incident.
Concept tested: Incident response procedures and documentation importance
Source: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.