CISM Incident Management Practice Question

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Eradicate the malware and restore systems

After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Eradicate the malware and restore systems
Why this is correct
Containment stops spread but leaves malicious artefacts resident. Eradication removes malware, persistence mechanisms, and compromised accounts, after which systems are restored from trusted backups. This follows the incident management lifecycle sequence, so eradication and restoration is the next step after containment.
✗
Perform root cause analysis
Why it's wrong here
Root cause analysis follows eradication and recovery, not containment; the incident is still live and evidence must be preserved first. It is tempting because understanding cause prevents recurrence, but that belongs in post-incident review after systems are restored.
✗
Conduct a lessons learned meeting
Why it's wrong here
Lessons learned occurs at the end of the incident lifecycle, after eradication, recovery and closure. It is tempting because it improves future response, but conducting it while containment is the latest completed phase skips the eradication and recovery stages the programme requires next.
✗
Notify regulatory authorities
Why it's wrong here
Regulatory notification is triggered by breach severity and legal timelines, not automatically as the step after containment. It is tempting because ransomware often mandates disclosure, but eradication and recovery must occur first, with notification handled per legal and contractual obligations.

Go deeper