Question

A security analyst has completed the investigation of a ransomware incident that affected a manufacturing plant. The CISO asks the analyst to write the executive summary section of the formal incident report for the board of directors and C-suite. Which content is MOST appropriate to include in this executive summary?

Accepted Answer

A high-level overview of the business impact, financial and operational consequences, and strategic recommendations to reduce future risk

Answer

The complete list of indicators of compromise, including file hashes, registry keys, and malicious IP addresses observed during the incident

Answer

A detailed timeline of every command executed by the attacker with corresponding Windows event log IDs and process trees

Answer

The raw packet captures and forensic disk image hashes used to preserve chain of custody during evidence collection