The best risk mitigation strategy requires building and implementing a CIRT response plan. This means you are preparing for potential computer/security incidents and practicing how to handle these incidents. Like any kind of remediation, the more you can plan, prepare, and practice, the more prepared you are to handle any risk situation.

1. How does a CIRT plan help an organization mitigate risk?
2. A computer forensic investigation has three phases. What are they? Describe the activities which happen in each phase. Have you seen or been a part of one? If so, what was it like?
3. Following a serious incident, post-mortem review meetings are conducted to review what happened. So how does the CIRT post-mortem review help mitigate risk? Use examples from your business context.
4. NIST SP 800-61 describes three models you can use for a CIRT. List the three models and describe how they function. Which would you prefer for your context and why?