Question

According to NIST 800-61 r2, Incident response teams should use which staffing model?

		All Employees
		Partially outsourced and partially employees
		All Outsourced
		Any of the above

Answer 1

According to NIST 800-61 r2, Incident response teams can also use all the above staffing model :

• Employees: The organization performs all of its incident response work, with limited technical and administrative support from contractors.

• Partially Outsourced: The organization outsources portions of its incident response work. . Although incident response duties can be divided among the organization and one or more outsourcers in many ways, a few arrangements have become commonplace: – The most prevalent arrangement is for the organization to outsource 24-hour-a-day, 7-day-a-week (24/7) monitoring of intrusion detection sensors, firewalls, and other security devices to an offsite managed security services provider (MSSP). The MSSP identifies and analyzes suspicious activity and reports each detected incident to the organization’s incident response team. Some organizations perform basic incident response work in-house and call on contractors to assist with handling incidents, particularly those that are more serious or widespread.

• Fully Outsourced: The organization completely outsources its incident response work, typically to an onsite contractor. This model is most likely to be used when the organization needs a full-time, onsite incident response team but does not have enough available, qualified employees.