BCM Incident Response and Crisis Management 2 — Questions and Answers
Question 1: During a crisis, what is the PRIMARY purpose of an Incident Command System (ICS)?
- To assign blame for the incident to responsible parties
- To provide a standardized, hierarchical structure for coordinating response activities (Correct answer)
- To communicate the incident to external media outlets
- To document losses for insurance claims
Correct answer: To provide a standardized, hierarchical structure for coordinating response activities
ICS provides a scalable, standardized management framework that unifies command and control across multiple agencies and organizations during an incident.
Question 2: Which crisis communication principle helps prevent rumor spread during an incident?
- Delaying all announcements until full information is available
- Proactively sharing timely, accurate information even if incomplete (Correct answer)
- Restricting all communication to senior leadership only
- Issuing a single press release after the incident is resolved
Correct answer: Proactively sharing timely, accurate information even if incomplete
Proactively communicating what is known, even if incomplete, fills the information vacuum that rumors exploit and builds stakeholder trust.
Question 3: What does the term 'crisis escalation threshold' refer to in incident response?
- The point at which legal counsel must be notified
- Pre-defined criteria that trigger activation of a higher response level or team (Correct answer)
- The maximum financial loss an organization can tolerate
- The number of staff required to staff an emergency operations center
Correct answer: Pre-defined criteria that trigger activation of a higher response level or team
Escalation thresholds define specific conditions—such as impact severity or duration—that automatically trigger activation of the next tier of response.
Question 4: Which element is MOST critical in an After-Action Review (AAR) following a crisis?
- Identifying personnel for disciplinary action
- Documenting what worked, what failed, and recommended improvements (Correct answer)
- Calculating the total financial cost of the incident
- Notifying regulators of lessons learned
Correct answer: Documenting what worked, what failed, and recommended improvements
An AAR's primary value is capturing honest observations about successes and gaps so that plans and procedures can be improved before the next event.
Question 5: In BCM, a 'hot site' differs from a 'warm site' primarily because a hot site:
- Is located in a warmer geographic climate for energy efficiency
- Has fully operational systems ready for immediate failover (Correct answer)
- Requires 24–72 hours of setup before operations can resume
- Is maintained by a third-party vendor rather than the organization
Correct answer: Has fully operational systems ready for immediate failover
A hot site mirrors production systems in real time and can support immediate failover, whereas a warm site requires some setup time before full operations resume.
Question 6: What is the role of the 'Public Information Officer (PIO)' during a crisis response?
- Managing technical recovery of IT systems
- Serving as the authorized spokesperson and coordinating external communications (Correct answer)
- Approving all financial expenditures during the incident
- Coordinating mutual aid agreements with partner agencies
Correct answer: Serving as the authorized spokesperson and coordinating external communications
The PIO manages all external communications, ensuring consistent, accurate messaging to media, public, and other stakeholders during an incident.
Question 7: Which best describes a 'tabletop exercise' in the context of crisis management?
- A full-scale physical simulation involving all staff and external agencies
- A discussion-based session where participants talk through a scenario without deploying resources (Correct answer)
- An unannounced test of emergency notification systems
- A review of physical security controls at a facility
Correct answer: A discussion-based session where participants talk through a scenario without deploying resources
Tabletop exercises are facilitated, discussion-based activities that walk participants through a hypothetical scenario to identify gaps without real-world resource deployment.
BCM Incident Response and Crisis Management 2
During a crisis, what is the PRIMARY purpose of an Incident Command System (ICS)?