CISM Incident Management Practice Question
A security manager is reviewing the incident response plan and notices that the plan does not specify how to handle a situation where the incident response team cannot reach the primary incident response manager. What should be done to address this gap?
⚠ Common exam trap
The trap here is thinking that escalation to a higher authority or outsourcing solves the problem, when the core issue is lack of a designated alternate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Designate an alternate incident response manager and include contact information in the plan.
The most effective way to address the lack of a backup for the incident response manager is to designate an alternate and include their contact details in the plan. This ensures that leadership is maintained even if the primary manager is unavailable. It is a simple, cost-effective, and standard practice in incident response planning, aligning with CISM's emphasis on preparedness and resilience.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Outsource incident response management to a third-party provider.
Why it's wrong here
Outsourcing may be part of a broader strategy, but it does not directly address the gap of an unavailable internal manager. Third-party providers may not have the same organizational context and could introduce delays. This option is an overreaction and may not be feasible for all incidents. The immediate need is to ensure internal continuity of leadership.
- ✗
Implement a policy that the incident response manager must always be available.
Why it's wrong here
A policy requiring constant availability is unrealistic and does not address unplanned absences. It also places undue burden on the individual and does not provide a backup. This option fails to create a resilient process. Instead, organizations should plan for contingencies, such as alternates, rather than relying on the availability of one person.
- ✗
Require all incident response team members to report to the CISO in the absence of the manager.
Why it's wrong here
While the CISO may provide oversight, the incident response team needs a dedicated manager to coordinate tactical activities. Reporting to the CISO could overwhelm that role and blur lines of authority. The CISO is typically part of the crisis management team and may not be available for operational decisions. This option does not provide a clear chain of command for the incident response team.
- ✓
Designate an alternate incident response manager and include contact information in the plan.
Why this is correct
Including an alternate incident response manager ensures continuity of leadership if the primary is unavailable. This is a critical component of incident response planning, as it prevents delays in decision-making during a crisis. The alternate should have the same authority and training as the primary. This addresses the gap directly and is a best practice for business continuity and incident management.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.