Post-Incident Analysis & Reporting Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Post-Incident Analysis & Reporting flashcards as text
What is the recommended tone for a post-incident report to promote psychological safety and honest reporting?
Answer: Blameless, focusing on systemic issues rather than individual fault
A blameless culture encourages honest disclosure of errors by focusing on process and system failures rather than punishing individuals.
Which metric in a post-incident report specifically measures how long the incident remained undetected after it began?
Answer: Mean Time to Detect (MTTD)
MTTD measures the elapsed time between when an incident starts and when it is first detected by responders or monitoring systems.
When multiple teams are involved in an incident response, what section of the post-incident report documents who did what and when?
Answer: Chronological action log / incident timeline
The chronological action log documents each team's actions with timestamps, providing accountability and enabling analysis of coordination effectiveness.
Which of the following best describes a 'systemic root cause' found in a post-incident analysis?
Answer: An underlying organizational, cultural, or process weakness that enabled the failure
Systemic root causes are organizational or process-level weaknesses that create conditions for multiple potential failure modes.
A post-incident report notes the incident 'escaped detection for 4 hours due to alert fatigue.' What type of finding is this?
Answer: Process and tooling finding related to monitoring effectiveness
Alert fatigue is a process/tooling problem where excessive or low-signal alerts cause responders to miss or ignore critical notifications.
What should an incident manager do if a corrective action from a previous PIR remains unimplemented at the time of a new similar incident?
Answer: Reference the unimplemented action, escalate urgency, and link it as a contributing factor in the new report
Unimplemented corrective actions that contribute to recurrent incidents must be escalated, linked in the new report, and treated with higher priority.
In post-incident analysis, 'latent conditions' refer to which of the following?
Answer: Pre-existing hidden flaws in systems or processes that become dangerous when combined with a trigger
Latent conditions (from James Reason's Swiss Cheese Model) are dormant weaknesses in systems that remain harmless until aligned with other failure factors.