Information Security Incident Management Flashcards

What is the FIRST step in the incident response lifecycle according to best practices?

Answer: Preparation

Preparation is the first phase of incident response, involving developing plans, training teams, and establishing capabilities before incidents occur.

During a security incident, who is PRIMARILY responsible for declaring an incident a 'major incident'?

Answer: A designated incident manager or crisis management team

A designated incident manager or crisis management team, with appropriate authority, is responsible for formally declaring and escalating major incidents.

Which of the following is the PRIMARY purpose of containment in incident response?

Answer: To limit the scope and impact of an ongoing incident

Containment limits the spread and impact of an active incident while preserving evidence and buying time for eradication and recovery.

A CISM is reviewing an incident response plan (IRP). Which element is MOST critical to include?

Answer: Defined escalation procedures and communication chains

Clearly defined escalation procedures and communication chains ensure that the right people are notified and empowered to act during an incident.

After an incident is resolved, which activity is MOST important to improve future response?

Answer: Conducting a post-incident review (lessons learned)

A post-incident review (lessons learned) identifies what worked, what failed, and improvements to prevent recurrence and enhance future response capability.

Which of the following BEST describes the purpose of an incident response retainer with a third-party firm?

Answer: To ensure pre-negotiated access to expert resources during a crisis

A retainer pre-negotiates access to specialized incident response expertise and resources, reducing response time and ensuring availability during a major incident.