CISM Incident Management Practice Question
An organization is required to notify regulators of a material cybersecurity incident within 4 business days. Which regulation imposes this requirement?
⚠ Common exam trap
A common trap on the ISACA CISM exam is confusing the SEC's 4-business-day requirement for material incident reporting with other notification timelines (e.g., GDPR's 72-hour breach notification), leading candidates to incorrectly apply privacy regulations to securities reporting obligations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SEC proposed rules
The SEC's proposed rules (now final) require publicly traded companies to report material cybersecurity incidents on Form 8-K within 4 business days of determining materiality. This is a specific U.S. securities regulation, not a privacy or payment card standard, and it directly mandates the 4-business-day notification window for material incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
California Consumer Privacy Act (CCPA)
Why it's wrong here
CCPA has different notification timelines.
- ✓
SEC proposed rules
Why this is correct
SEC rules mandate 4 business day notification for material incidents.
- ✗
GDPR
Why it's wrong here
GDPR requires notification within 72 hours, not 4 business days.
- ✗
PCI DSS
Why it's wrong here
PCI DSS has its own requirements, not 4-day notification.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.