CISM Incident Management Practice Question
An organization's incident response plan defines communication procedures, but during a recent incident, customers learned about a data breach from media reports before receiving any notification from the company. The information security manager has been asked to address this gap. Which of the following is the MOST effective improvement?
⚠ Common exam trap
The trap here is reaching for confidentiality controls or public transparency when the real failure is an unprepared, slow notification workflow among legal, communications, and executives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pre-drafting notification templates and defining approval workflows with legal, communications, and executive stakeholders
When customers learn of a breach from media before official notice, the root cause is usually slow or undefined notification workflow. Pre-drafted templates plus agreed approval paths among legal, communications, and executives compress the time from confirmation to notification, ensuring the organization controls the narrative and meets regulatory deadlines. The other options either target unrelated risks or only partially address the coordination gap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pre-drafting notification templates and defining approval workflows with legal, communications, and executive stakeholders
Why this is correct
Pre-approved templates and defined approval paths remove the delays and ambiguity that allow rumors or media to outpace official communication. By aligning legal, communications, and executives in advance, the organization can issue accurate, timely notifications within regulatory windows and preserve stakeholder trust. This directly addresses the gap of customers hearing from media first.
- ✗
Requiring all employees to sign an updated nondisclosure agreement covering incident details
Why it's wrong here
Confidentiality agreements may reduce unauthorized internal disclosure, but they do not accelerate external notification or prevent media from reporting independently. The failure described is that official communication arrived too late, not that employees leaked. This control does not address the timing and coordination problem, so it would not have changed the outcome.
- ✗
Publishing the full incident response plan on the corporate website to demonstrate transparency
Why it's wrong here
Publishing the response plan exposes defensive procedures and contact structures to adversaries and does not ensure timely breach notification. Transparency with stakeholders is important, but releasing operational playbooks is a poor substitute for a coordinated notification process. This action could increase risk while leaving the core communication timing problem unresolved.
- ✗
Adding a public relations representative to the technical incident response team
Why it's wrong here
Embedding communications expertise in the response team can improve messaging, but it does not by itself create the pre-approved content and decision authority needed to notify quickly. Without prepared templates and clear approval paths, even an embedded representative faces the same delays. The improvement is partial and does not fully close the gap identified in the scenario.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.