CISM Incident Management Practice Question
A financial services firm has activated its incident response team for a suspected insider data theft. The legal department advises that the matter may become a criminal case. The security manager must decide how to handle the forensic images and analyst notes. Which action BEST supports both the investigation and potential legal proceedings?
⚠ Common exam trap
The trap here is treating evidence like ordinary IT data that needs redundancy or cleanup, rather than recognizing that legal admissibility requires isolation, hashing, and documented custody.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Maintain a documented chain of custody with hash values and restricted access to the evidence repository
When an incident may become a criminal or civil legal matter, evidence must be handled so that it remains admissible and defensible. Chain of custody documentation, cryptographic hashing, and strict access controls are the core requirements. These practices demonstrate that evidence has not been altered and that only authorized personnel handled it. Other options either contaminate evidence, expose it to unauthorized parties, or destroy potentially discoverable material.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete analyst working notes after the final report is issued to reduce discoverable material
Why it's wrong here
Destroying analyst notes can constitute spoliation of evidence, which courts may sanction severely, including adverse inference instructions. Working notes may contain observations, timestamps, and reasoning that are relevant to the case. CISM guidance requires preservation of all incident-related documentation when litigation is reasonably anticipated. Reducing discoverable material is not a legitimate evidence management strategy.
- ✗
Store all evidence on the same file server used for routine IT backups to ensure redundancy
Why it's wrong here
Storing evidence alongside routine backups exposes it to overwriting, unauthorized access, and contamination by normal backup cycles. It also breaks the chain of custody because access cannot be tightly controlled or logged. For potential criminal proceedings, evidence must be isolated and access-restricted. Convenience and redundancy do not outweigh the need for integrity and admissibility in this scenario.
- ✗
Allow the suspect's manager to review the forensic images to confirm whether the data was sensitive
Why it's wrong here
Granting a manager access to forensic images introduces contamination risk, breaks the chain of custody, and may compromise the investigation or tip off the subject. Sensitivity of data can be determined through data classification records and metadata analysis by authorized personnel. Involving non-forensic staff in evidence review undermines both legal admissibility and the integrity of the internal investigation.
- ✓
Maintain a documented chain of custody with hash values and restricted access to the evidence repository
Why this is correct
A documented chain of custody, cryptographic hashes, and access controls preserve evidence integrity and demonstrate that it has not been altered. This is essential for admissibility in legal proceedings and for defending investigative conclusions. CISM emphasizes that evidence handling procedures must be defined before incidents occur and followed rigorously, especially when criminal prosecution or regulatory action is possible.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.