Establishing incident alert thresholds is an activity recommended by the _________ function within the NIST CSF.

Question

BlackTom AI · Accepted Answer

Establishing incident alert thresholds is a detection activity: it belongs to the Detect function of the NIST Cybersecurity Framework (NIST CSF).

1) Relevant knowledge points and concepts
- NIST CSF organizes cybersecurity activities into five core functions: Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).
- The Detect function covers timely discovery of cybersecurity events and anomalies. Its categories include Anomalies and Events (DE.AE), Security Continuous Monitoring (DE.CM), and Detection Processes (DE.DP), which include setting thresholds, alerting rules, and detection procedures.
- Alerts and thresholds are part of monitoring and detection design: they determine when observed conditions escalate into actionable events.

2) Step-by-step reasoning
Step 1: Define the action — “establishing incident alert thresholds” means selecting metrics and trigger points that convert monitored signals into alerts.
Step 2: Map the action to CSF functions — selecting thresholds is part of designing detection mechanisms and continuous monitoring systems, which are explicitly in the Detect function (DE.CM / DE.DP).
Step 3: Confirm by intent — thresholds enable timely discovery, which is the Detect function’s primary purpose.

3) Intermediate logic steps (no numeric calculations required)
- Monitoring tools collect telemetry (logs, network traffic, etc.).
- Thresholds/rules determine when telemetry indicates an incident.
- Once thresholds are met, alerts are generated so response processes can start.

4) Why the correct answer is correct
Because thresholds are preventative/detection configuration elements used to identify anomalies and trigger alerts; that design and maintenance fall squarely under Detect in NIST CSF.

5) Why other options are incorrect
- Identify: focuses on assets, risk assessment, governance — not setting monitoring thresholds.
- Respond: deals with actions taken after detection (response planning, mitigation), not the setup of detection triggers.
- Recover: concerns restoration and resilience after incidents, not detection configuration.

Conclusion: The Detect function is the correct choice; this matches the provided answer: Detect.

Establishing incident alert thresholds is an activity recommended by the _________ function within the NIST CSF.Single choice

Similar Questions

Containing and mitigating incidents is an activity recommended by the _________ function within the NIST CSF.

Voluntarily sharing information with external stakeholders to achieve broader cybersecurity situational awareness is an activity recommended by the _________ function within the NIST CSF.

Performing computer or network Forensics is an activity recommended by the _________ function within the NIST CSF.

Managing public relations and the organization's reputation is an activity recommended by the _________ function within the NIST CSF.

You own a bond that pays $64 in interest annually. The face value is $1,000 and the current market price is $1,021.61. The bond matures in 11 years. What is the yield to maturity?

Which of the following statements is CORRECT?

More Practical Tools for Students Powered by AI Study Helper

Homework AI Solver

Stylized AI Paper Writer

Plagiarism Checker Assistant

Citation AI Academic Writing Tool

In-Class Translation Assistant

AI Note Generator

AI Quiz Answers

Past Exam Questions from University Test Bank

Smart Practice Assistant

Adaptive Practice

Making Your Study Simpler