Information Security Incident Management Flashcards

Which of the following BEST describes 'forensic preservation' during incident response?

Answer: Collecting and preserving evidence in a manner that maintains its integrity for investigation

Forensic preservation involves collecting evidence using documented, integrity-preserving methods to support investigation and potential legal proceedings.

A CISM is establishing notification procedures for data breach incidents. Under US regulations, breach notification timing is MOST influenced by:

Answer: State breach notification laws and applicable federal regulations

US data breach notification requirements are governed by state laws and federal sector-specific regulations, which define mandatory notification timelines.

Which of the following is the MOST important factor in determining incident severity?

Answer: The potential business impact of the incident

Incident severity should be determined by potential business impact — the degree of harm to operations, data, reputation, and stakeholders.

During an active ransomware incident, the FIRST priority of the CISM should be to:

Answer: Activate the incident response plan and isolate affected systems

Activating the incident response plan and isolating affected systems are the immediate priorities to contain the ransomware and prevent further spread.

Which of the following BEST describes the role of a CISM during a major security incident?

Answer: Providing strategic oversight, coordination, and communication

During a major incident, the CISM's role is strategic — providing oversight, coordinating the response team, and managing communication with leadership.

An organization experiences a security incident involving a third-party vendor's system. The CISM should FIRST:

Answer: Invoke the vendor's contractual incident notification and response obligations

Contractual incident notification and response obligations should be invoked immediately to ensure the vendor takes required action and shares necessary information.