CISM Information Security Program Practice Question
After a data breach, the CISO is updating the incident response plan. Which of the following is MOST critical to include?
⚠ Common exam trap
CISM often tests the distinction between strategic plan components (like communication templates) and tactical/operational details (like forensic procedures or root cause analysis), tempting candidates to choose a technically detailed option that is not the most critical for the plan's immediate post-breach effectiveness.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Communication templates for stakeholders
After a data breach, the incident response plan must prioritize clear, consistent communication to manage stakeholder expectations, regulatory notifications, and legal repercussions. Communication templates ensure that notifications to customers, regulators, and executives are accurate, timely, and compliant with breach notification laws (e.g., GDPR Article 33, state-specific 72-hour requirements). Without predefined templates, the response team risks delays or inconsistent messaging, which can exacerbate reputational damage and legal liability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Communication templates for stakeholders
Why this is correct
Effective communication is vital to control damage and meet legal obligations.
- ✗
Technical forensic procedures
Why it's wrong here
Forensics are necessary but not the most critical for immediate response.
- ✗
Root cause analysis methodology
Why it's wrong here
Root cause analysis is conducted after the incident is contained.
- ✗
Legal hold instructions for data preservation
Why it's wrong here
Legal holds are important but can be addressed after initial communication.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.