Which resource does the material identify as NIST guidance for incident handling?

### Why this is right The material names National Institute of Standards and Technology (NIST) Special Publication 800-61, *Computer Security Incident Handling Guide*, as a resource for practitioners and as guidance on incident response elements. ### The concept A guide supports organizations as they develop an incident response plan and response capability. The material emphasizes that response is not purely technical: cybersecurity situations can also affect business operations. The guide’s role differs from a team mission statement, a provider’s alert, or an attack life-cycle model. ### The other options - **B. The Mandiant Cyber Attack Life Cycle**: This describes attacker stages, not the named incident handling guide. - **C. A managed security service provider alert report**: A provider may generate alerts, but that report is not the resource identified as NIST guidance. - **D. An organization's mission statement**: A mission statement gives the program purpose; it is not the named external guide. ### Terms - **NIST**: National Institute of Standards and Technology, the organization publishing the referenced guidance. - **Incident response**: Organized action to assess and address a cybersecurity incident. ### Remember SP 800-61 is identified as the Computer Security Incident Handling Guide.