Certified Incident Handler (CIH) Practice Ecam

Which of the following describes a beneficial procedure after an OT security incident?

1. Documenting all security activities performed

2. Ignoring unnoticed anomalies

3. Deleting all system logs post-incident

4. Limiting communication with external parties

The correct answer is: Documenting all security activities performed

The choice highlighting the importance of documenting all security activities performed after an OT security incident is crucial for several reasons. Detailed documentation serves as a vital record that can help in understanding the sequence of events during the incident, the response actions taken, and the effectiveness of those actions. This record is essential for conducting a thorough post-incident analysis, which can reveal insights into the vulnerabilities that were exploited and guide improvements in security measures to prevent future incidents. Additionally, documentation is important for compliance purposes, as many regulatory frameworks require organizations to maintain records of security incidents and responses. It also supports communication with stakeholders, as well as providing information for law enforcement if needed. Overall, thorough documentation not only assists in the immediate aftermath of an incident but also strengthens an organization’s overall security posture for the future.