Mysystem.org IT ExamsCISM Question 145 2017-04-06
Question: If an organization considers taking legal action on a security incident, the information security manager should focus PRIMARILY on:
A.) obtaining evidence as soon as possible.
Answer ==> B.) preserving the integrity of the evidence.
C.) disconnecting all IT equipment involveD.)
D.) reconstructing the sequence of events.