Certified Information Security Manager (CISM)Incident ManagementMedium
A managed security service provider (MSSP) detects anomalous outbound network traffic from a client's server, indicating potential data exfiltration. The client's incident response plan states that the incident coordinator must be notified within 15 minutes. What is this 15-minute timeframe an example of?
- AMaximum Tolerable Downtime (MTD).
- BRecovery Point Objective (RPO).
- CService Level Agreement (SLA).
- DRecovery Time Objective (RTO).
Show answer & explanationAnswer & explanation
Correct answer: C. Service Level Agreement (SLA).
The 15-minute notification timeframe is a commitment between the MSSP (service provider) and the client (service recipient) regarding a specific service parameter (incident notification). This type of commitment, outlining expected performance or response times, is typically defined within a Service Level Agreement (SLA).
Why the other options are wrong
- A. MTD relates to the maximum acceptable downtime for a business function, not a notification metric.
- B. RPO relates to data loss tolerance, not notification time.
- D. RTO relates to the target time to restore a system or service, not the time to notify personnel.
Service Level Agreement (SLA)
A contractual agreement that defines the level of service expected from a service provider, including metrics like uptime, response times, and responsibilities.
- Legally binding document.
- Specifies performance metrics and penalties for non-compliance.
- Common in outsourced IT services and cloud computing.
Memory trick: SLAs are the 'Service Law' for incidents.