GIAC
GCIH · Question #475
Why should you inform incident handling team members in advance of their joining the team that they may be required to testify in a court of law?
The correct answer is B. To make sure they understand that it is a requirement that could follow them for several years. Inform them that they may be required to testify. This may scare them, but that is OK, sometimes it takes a long time to bring an incident to closure.
Incident Response & Cyber Kill Chain
Question
Why should you inform incident handling team members in advance of their joining the team that they may be required to testify in a court of law?
Options
- ABecause most cases eventually end up in court
- BTo make sure they understand that it is a requirement that could follow them for several years
- CTo verify their abilities to hold up under cross-examination
- DBecause US Code Section 1030 requires that all incident handlers receive such notification
How the community answered
(55 responses)- A2% (1)
- B91% (50)
- C5% (3)
- D2% (1)
Explanation
Inform them that they may be required to testify. This may scare them, but that is OK, sometimes it takes a long time to bring an incident to closure.
Topics
#legal proceedings#incident handler responsibilities#court testimony#incident documentation
Community Discussion
No community discussion yet for this question.