CIM Post-Incident Analysis & Reporting 2 — Questions and Answers
Question 1: What is the primary purpose of a 'timeline reconstruction' during a post-incident analysis?
- To assign blame to specific team members
- To establish the sequence of events and decisions that led to and during the incident (Correct answer)
- To calculate the total cost of the incident
- To determine which monitoring tools failed
Correct answer: To establish the sequence of events and decisions that led to and during the incident
Timeline reconstruction establishes a factual chronological sequence of events, enabling analysts to identify causal chains and decision points.
Question 2: In a post-incident report, what does 'contributing factor' mean as distinct from 'root cause'?
- A contributing factor is always a human error, while root cause is always technical
- A contributing factor increased the likelihood or impact of the incident but was not the primary cause (Correct answer)
- A contributing factor is identified after the root cause is fixed
- A contributing factor is only relevant in major incidents
Correct answer: A contributing factor increased the likelihood or impact of the incident but was not the primary cause
Contributing factors are conditions or actions that worsened the incident's likelihood or impact without being the single root cause.
Question 3: Which technique is commonly used in post-incident analysis to iteratively ask 'Why?' until the root cause is identified?
- SWOT analysis
- 5 Whys (Correct answer)
- RACI matrix
- Pareto analysis
Correct answer: 5 Whys
The 5 Whys technique drills down through layers of symptoms by repeatedly asking why each effect occurred until the root cause is reached.
Question 4: When should a post-incident review (PIR) meeting ideally be scheduled after a major incident?
- Immediately after resolution while details are fresh, typically within 24-72 hours (Correct answer)
- One month after the incident to allow full recovery
- Only after all corrective actions are implemented
- At the end of the fiscal quarter
Correct answer: Immediately after resolution while details are fresh, typically within 24-72 hours
PIRs should occur quickly after resolution—within 24-72 hours—so that participants' memories are still accurate and evidence is intact.
Question 5: What is 'normalization of deviance' in the context of post-incident analysis?
- Accepting small deviations from procedures as normal over time, increasing systemic risk (Correct answer)
- A statistical method for normalizing incident data
- The process of documenting unusual incident behaviors
- A technique for categorizing security deviations
Correct answer: Accepting small deviations from procedures as normal over time, increasing systemic risk
Normalization of deviance occurs when teams gradually accept non-standard practices as routine, often preceding major failures.
Question 6: In a post-incident fishbone (Ishikawa) diagram, the 'bones' typically represent which elements?
- Individual responders and their actions
- Categories of potential causes such as people, process, technology, and environment (Correct answer)
- The timeline of events from detection to resolution
- Metrics used to measure incident severity
Correct answer: Categories of potential causes such as people, process, technology, and environment
Fishbone diagrams organize potential causes into categories (e.g., People, Process, Technology, Environment) branching off the main incident effect.
Question 7: What distinguishes a 'lessons learned' document from a corrective action plan in post-incident reporting?
- Lessons learned identifies what went wrong; corrective action plan specifies what will be done to prevent recurrence (Correct answer)
- They are identical documents with different names
- Corrective action plans are only required for P1 incidents
- Lessons learned documents are optional; corrective action plans are mandatory
Correct answer: Lessons learned identifies what went wrong; corrective action plan specifies what will be done to prevent recurrence
Lessons learned captures insights and findings, while a corrective action plan defines specific, assigned, time-bound steps to address those findings.
CIM Post-Incident Analysis & Reporting 2
What is the primary purpose of a 'timeline reconstruction' during a post-incident analysis?