easyMultiple ChoiceObjective-mapped
CISM Practice Question: After a security incident, the incident response…
After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?
⚠ Common exam trap
It's easy for candidates to confuse the audience for the detailed technical incident report (which goes to IT and the incident response team) with the audience for the lessons-learned executive summary, which is specifically designed for senior management and the board.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Senior management and the board of directors
The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The affected users
Why it's wrong here
Users may need some communication but not the detailed report.
- ✓
Senior management and the board of directors
Why this is correct
They need to make strategic decisions based on the incident.
- ✗
The IT support team
Why it's wrong here
IT support may need technical details, but the primary audience is management.
- ✗
External auditors
Why it's wrong here
External auditors may request the report, but it is not the primary audience.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.