Organizing the incident response planning process begins with staffing the disaster recovery committee.

The committees of the CPMT follow a set of general stages to develop their subordinate plans. In the case of incident planning, the first stage is to ____.

The responsibility for creating an organization’s IR plan often falls to the ____.

E-mail spoofing attacks require an immediate response, typically no more than 30 minutes to one hour.

General users require training on the technical details of how to do their jobs securely, including good security practices, ____ management, specialized access controls, and violation reporting.

A recommended practice for the implementation of the physical IR plan document is to organize the contents so that the first page contains the ____ actions.

One of the primary responsibilities of the IRP team is to ensure that the ____ is prepared to respond to each incident it may face.

A(n) ____ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.

The Southeast Collegiate Cyber Defense Competition is unique in that it focuses on the operational aspect of managing and protecting an existing network infrastructure. Unlike “capture-the-flag ” exercises, this competition is exclusively a real-world ____ competition.

A single trainer works with multiple trainees in a formal setting

Can serve as a training case for future staff

Defines roles and responsibilities for information security

Too risky for most businesses

Trainees receive a seminar presentation at their computers

A source of information for developing IR policy

An online resource for IR

A review of an unusual pattern of entries in a system log

Usually activated when an incident causes minimal damage with little or no disruption to business operations