2 cissp ® Official Study Guide Eighth Edition

Response
After detecting and verifying an incident, the next step is response. The response varies 
depending on the severity of the incident. Many organizations have a designated incident 
response team—sometimes called a computer incident response team (CIRT), or computer 
security incident response team (CSIRT). The organization activates the team during a major 
security incident but does not typically activate the team for minor incidents. A formal inci-
dent response plan documents who would activate the team and under what conditions.
Team members are trained on incident response and the organization’s incident response 
plan. Typically, team members assist with investigating the incident, assessing the damage, 
collecting evidence, reporting the incident, and recovery procedures. They also participate 
in the remediation and lessons learned stages, and help with root cause analysis.
The quicker an organization can respond to an incident, the better chance they have 
at limiting the damage. On the other hand, if an incident continues for hours or days, the 
damage is likely to be greater. For example, an attacker may be trying to access a customer 
database. A quick response can prevent the attacker from obtaining any meaningful data. 
However, if given continued unobstructed access to the database for several hours or days, 
the attacker may be able to get a copy of the entire database.

---

742
Chapter 17 
■
Preventing and Responding to Incidents
After an investigation is over, management may decide to prosecute responsible individu-
als. Because of this, it’s important to protect all data as evidence during the investigation. 
Chapter 19, “Investigations and Ethics,” covers incident handling and response in the 
context of supporting investigations. If there is any possibility of prosecution, team mem-
bers take extra steps to protect the evidence. This ensures the evidence can be used in legal 
procedures. 
Computers should not be turned off when containing an incident. Tempo-
rary files and data in volatile random access memory (RAM) will be lost if 
the computer is powered down. Forensics experts have tools they can use 
to retrieve data in temporary files and volatile RAM as long as the system 
is kept powered on. However, this evidence is lost if someone turns the 
computer off or unplugs it.