Incident Response and Crisis Management Flashcards
7 cards from real BCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response and Crisis Management flashcards as text
Which phase of the incident response lifecycle focuses on limiting the spread and impact of an active threat?
Answer: Containment
Containment aims to stop an incident from worsening or spreading while the organization gathers information and plans further response steps.
A BCM practitioner reviewing crisis communication plans should ensure messages follow the 'SMEAC' framework. What does the 'E' stand for?
Answer: Execution
In SMEAC (Situation, Mission, Execution, Administration/Logistics, Command/Signal), 'Execution' describes how the mission will be carried out.
When categorizing incidents by severity, which factor MOST directly influences the assignment of a 'critical' severity level?
Answer: The potential for widespread operational disruption or life-safety impact
Severity levels are driven by potential impact—critical incidents threaten core operations, safety, or organizational survival, not by when or where they originate.
What is 'mutual aid' in the context of crisis and emergency management?
Answer: Pre-arranged agreements between organizations to share resources during emergencies
Mutual aid agreements allow organizations or jurisdictions to request and receive resources—personnel, equipment, supplies—from partners during emergencies they cannot handle alone.
Which document formally authorizes the activation of an organization's Business Continuity Plan?
Answer: The crisis declaration or activation notice issued by authorized leadership
A formal crisis or continuity declaration by designated authority—such as the CEO or Crisis Management Team leader—is required to officially activate the BCP.
In incident response, what is 'forensic preservation' and why is it important?
Answer: Securing and maintaining evidence in its original state to support investigation or legal proceedings
Forensic preservation protects the integrity of evidence so it can be analyzed and, if needed, admitted in legal or regulatory proceedings without contamination.
Which metric is used to measure how quickly an organization can detect and begin responding to a security incident?
Answer: Mean Time to Detect (MTTD)
MTTD measures the average time between the occurrence of an incident and its detection by the organization, reflecting the effectiveness of monitoring and alerting systems.