Incident Response and Crisis Management Flashcards
7 cards from real BCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response and Crisis Management flashcards as text
An organization experiences a ransomware attack on a Friday evening. The FIRST action under an incident response plan should be to:
Answer: Activate the incident response team and begin isolation of affected systems
Activating the IRT and isolating affected systems limits further spread while enabling an organized, evidence-preserving response rather than a reactive shutdown.
Which BCM standard provides globally recognized guidance on incident management and crisis management practices?
Answer: ISO 22301
ISO 22301 is the international standard for Business Continuity Management Systems and includes requirements for incident response and crisis management integration.
What is the significance of establishing a 'single source of truth' during an active crisis?
Answer: It ensures all decision-makers operate from the same verified situational data, reducing conflicting actions
A single source of truth prevents the chaos of teams acting on conflicting information, ensuring coordinated and consistent decision-making throughout the incident.
During a crisis exercise debrief, a facilitator identifies that responders 'normalized deviance' in their decision-making. This means they:
Answer: Repeatedly accepted risky shortcuts as acceptable because nothing bad had happened yet
Normalized deviance occurs when repeated violations of safe procedures without immediate consequences lead teams to treat risky behavior as the new normal, increasing catastrophic failure risk.
Which element of a crisis communication plan ensures messages remain consistent across multiple spokespeople and channels?
Answer: Approved key message frameworks with pre-cleared language and talking points
Pre-approved key messages ensure that regardless of who is speaking or which channel is used, the organization's core narrative remains consistent and aligned.
What does 'continuity of operations' (COOP) planning primarily aim to preserve during a disruptive event?
Answer: The performance of essential functions without interruption, regardless of the disruption's scale
COOP planning ensures that mission-critical functions continue even when primary facilities, systems, or personnel are unavailable due to a disruption.
A BCM manager is designing an incident severity classification system. Which criteria set is MOST appropriate for determining severity?
Answer: Scope of impact, operational disruption, financial exposure, and life-safety risk
Effective severity classification uses multi-dimensional impact criteria—operational, financial, and life-safety—rather than circumstantial factors like time or location.