CISM Incident Management Practice Question
An organization is defining the composition of its incident response team. Which role is PRIMARILY responsible for coordinating communication with the media and the public during a high-profile incident?
⚠ Common exam trap
The trap here is assuming the incident response manager or legal counsel handles all incident communication, when external media and public messaging is a distinct communications function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The public relations or communications lead.
External communication during a high-profile incident belongs to a designated communications or public relations lead who can align messaging with legal requirements and executive direction. This separation keeps technical responders focused on containment and recovery while ensuring the organization speaks with one consistent voice. Legal counsel reviews for risk, and the incident response manager supplies accurate technical context, but neither owns the media and public communication role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The public relations or communications lead.
Why this is correct
The communications lead owns the organization's external messaging, including media statements, public disclosures, and stakeholder updates. During a high-profile incident, this role works with legal, executive leadership, and the incident response manager to ensure accurate, consistent, and timely communication while protecting the organization's reputation and meeting disclosure obligations.
- ✗
The legal counsel.
Why it's wrong here
Legal counsel advises on notification obligations, privilege, and regulatory exposure, and may review public statements for legal risk. However, counsel does not typically own the communication strategy or act as the organization's spokesperson. The primary responsibility for media and public messaging rests with a dedicated communications function that coordinates with legal and executive leadership.
- ✗
The IT operations director.
Why it's wrong here
The IT operations director focuses on restoring systems, managing infrastructure changes, and maintaining service availability during the incident. While this role supplies technical facts, it is not responsible for crafting or delivering public statements. Assigning media communication to an operations leader risks technical jargon, inconsistent messaging, and distraction from recovery tasks.
- ✗
The incident response manager.
Why it's wrong here
The incident response manager coordinates the technical and operational response, including triage, containment, and recovery activities. While this role may provide factual updates to leadership, managing media and public messaging is not its primary function. Mixing technical coordination with external communications can create inconsistent messaging and distract from containment during a high-profile event.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.