Which statement about cyber security incident reporting timelines is correct?

Which statement about cyber security incident reporting timelines is correct?

• A. They are not prescribed by any standard
• B. They are prescribed by NIST guidelines
• C. They are prescribed by CIP (Critical Infrastructure Protection) standards
• D. They are determined by regional market operators

Answer: (B)

The fundamental idea is that the timing for reporting cyber security incidents isn’t chosen arbitrarily; it comes from established guidance that specifies when and to whom incidents should be reported to enable prompt containment and coordinated response. In practice, the timeframes for incident handling and notification are grounded in widely adopted guidelines, with NIST providing the core reference point for these timelines (for example, in incident handling guidance like NIST SP 800-61 and related materials). These guidelines outline the steps and escalation paths for incident response, including the expected reporting windows to appropriate stakeholders. In the context of reliability and industry practice, CIP standards align with these widely used guidelines, so referring to NIST guidelines as prescribing the timelines captures the common basis for these requirements.

The fundamental idea is that the timing for reporting cyber security incidents isn’t chosen arbitrarily; it comes from established guidance that specifies when and to whom incidents should be reported to enable prompt containment and coordinated response. In practice, the timeframes for incident handling and notification are grounded in widely adopted guidelines, with NIST providing the core reference point for these timelines (for example, in incident handling guidance like NIST SP 800-61 and related materials). These guidelines outline the steps and escalation paths for incident response, including the expected reporting windows to appropriate stakeholders. In the context of reliability and industry practice, CIP standards align with these widely used guidelines, so referring to NIST guidelines as prescribing the timelines captures the common basis for these requirements.