CIM Crisis Communication & Notifications 2 — Questions and Answers
Question 1: When a major incident is escalated, who is typically the FIRST external audience to notify?
- Senior leadership and executive sponsors (Correct answer)
- End users and affected customers
- Regulatory bodies and auditors
- Vendors and third-party suppliers
Correct answer: Senior leadership and executive sponsors
Senior leadership must be notified first so they can authorize resources, set communication tone, and make high-level decisions.
Question 2: A 'bridge call' during a major incident is best described as:
- A daily standup meeting for the operations team
- A multi-party conference call used to coordinate incident response in real time (Correct answer)
- A post-incident review session with stakeholders
- A scheduled check-in with vendors about SLA compliance
Correct answer: A multi-party conference call used to coordinate incident response in real time
A bridge call is a real-time multi-party call that brings together all response teams to coordinate actions and share status during an active incident.
Question 3: Which principle ensures that stakeholders receive only the information relevant to their role during a crisis?
- Transparency
- Need-to-know (Correct answer)
- Completeness
- Redundancy
Correct answer: Need-to-know
The need-to-know principle limits information sharing to individuals who require it for their specific responsibilities, reducing noise and protecting sensitive data.
Question 4: What is the primary purpose of an incident communication log?
- To document all messages sent and received during the incident for audit and learning (Correct answer)
- To automatically notify stakeholders via email and SMS
- To track SLA compliance and penalty calculations
- To prioritize which teams should be notified first
Correct answer: To document all messages sent and received during the incident for audit and learning
The communication log creates an auditable record of all notifications, updates, and decisions made during the incident lifecycle.
Question 5: During an ongoing incident, how frequently should status updates be sent to affected business units when no resolution is in sight?
- Only when the incident is resolved
- At predefined regular intervals (e.g., every 30–60 minutes) (Correct answer)
- Once per day at end of business
- Only when the severity changes
Correct answer: At predefined regular intervals (e.g., every 30–60 minutes)
Regular interval updates keep stakeholders informed and reduce inbound status calls that distract the response team.
Question 6: Which element should ALWAYS be included in an initial incident notification to stakeholders?
- Root cause analysis and full technical details
- Estimated time to resolution, scope of impact, and next update time (Correct answer)
- Names of team members responsible for the outage
- Cost impact and SLA penalty projections
Correct answer: Estimated time to resolution, scope of impact, and next update time
Initial notifications must convey what is known about impact, an ETA if available, and when stakeholders will next hear from the team.
Question 7: A 'dark site' in crisis communication refers to:
- An unmonitored social media account
- A pre-built standby website activated during a crisis to publish updates (Correct answer)
- An internal-only status page blocked from public access
- A backup data center used during failover events
Correct answer: A pre-built standby website activated during a crisis to publish updates
A dark site is a pre-staged, pre-approved website kept offline until a crisis occurs, at which point it is activated to serve as the official communications hub.
CIM Crisis Communication & Notifications 2
When a major incident is escalated, who is typically the FIRST external audience to notify?