Explain the Significance of Incident Recovery Communication and Associated Security Controls in the RECOVER Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A multinational corporation is recovering from a supply chain attack that affected its internal development environment. The recovery team must communicate with the software vendor, the company's legal team, and the development teams. The vendor is demanding detailed technical logs to assist with their own investigation, but the legal team has advised that sharing certain logs could compromise the company's legal position in potential litigation. The recovery team must balance transparency with legal risk. What is the best course of action?

   • ARefuse to share any logs with the vendor until the legal investigation is complete.
   • BHave the legal team review the logs and provide a redacted subset to the vendor, with a clear explanation of why certain data is withheld.
   • CShare all requested logs with the vendor immediately to maintain a good relationship and expedite recovery.
   • DProvide the logs to the vendor but require them to sign a non-disclosure agreement (NDA) first.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A bank is recovering from a data breach that may have exposed customer financial information. The recovery team must coordinate with the bank's legal counsel, the federal regulator, and the public relations team. The regulator requires a formal notification within 72 hours, but the legal counsel advises that the full investigation is not complete and the notification may need to be updated later. The PR team wants to issue a public statement immediately to control the narrative. What is the best course of action?

   • AHave the PR team issue the public statement and the legal counsel submit the regulator notification independently.
   • BWait for the full investigation to complete before submitting the regulator notification or issuing a public statement.
   • CSubmit the regulator notification within the 72-hour deadline with the information available, and coordinate with PR to issue a carefully vetted public statement.
   • DIssue the public statement immediately and submit the regulator notification after the investigation is complete.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A manufacturing company is coordinating recovery with an external forensics vendor. They need to share sensitive production system logs and recovery status reports over the internet. The security team wants to ensure that the data is protected from interception and that only the vendor's assigned analysts can access it. Which combination of security controls best meets this requirement?

   • AEncrypt the files with a password shared over a separate phone call and email them to the vendor's general inbox.
   • BPost the files to a shared cloud drive and share the link publicly so the vendor can access them from any device.
   • CUse a secure file transfer portal with TLS encryption and require each vendor analyst to authenticate with multi-factor authentication (MFA).
   • DSend the files as unencrypted attachments to the vendor's project manager and ask them to distribute internally.
   Reveal Solution Discussion Select an answer first