NIST Special Publication 800-61 Revision 2 and ISO/IEC 27035 prescribe one identical incident response plan template for every organization.

### Why this is right The statement is false. The course material describes these references as guidance for incident handling and incident management, not as a single mandatory template suitable for every organization. ### The concept Standards and professional guidance help organizations structure their work, but plans should reflect organizational risks, assets, legal context, staffing, and resources. A small organization and a multinational enterprise may need different procedures while both use sound response principles. The course also notes that plans should be tested and updated as environments change. ### The other options - **The statement is false**: The material explicitly says the standards do not prescribe a one-size-fits-all template. ### Terms - **NIST**: National Institute of Standards and Technology, the United States organization that publishes the referenced incident handling guide. - **ISO/IEC**: International Organization for Standardization and International Electrotechnical Commission, bodies that publish international standards. ### Remember Use standards to shape a plan, then tailor the plan to the organization.