CISM Incident Management Practice Question
During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)
⚠ Common exam trap
A common mix-up: candidates confuse the Incident Response Team (IRT) with the Crisis Management Team (CMT), incorrectly selecting operational roles like security analyst or incident response manager instead of the executive leadership roles that constitute the CMT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Chief executive officer (CEO)
The CEO is correct because as the highest-ranking executive, they provide strategic direction, authorize critical decisions (e.g., public disclosure, resource allocation), and serve as the primary liaison to the board of directors during a major incident. The GC is correct because they manage legal risks, ensure compliance with breach notification laws (e.g., GDPR, CCPA), and oversee communications with regulators and law enforcement. The CFO is correct because they assess financial impacts, approve emergency budgets, and coordinate with insurance carriers for cyber liability claims.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Chief executive officer (CEO)
Why this is correct
CEO provides executive leadership.
- ✓
General counsel (GC)
Why this is correct
GC provides legal advice and privilege.
- ✗
Security analyst
Why it's wrong here
Security analysts are part of the IR team, not CMT.
- ✗
Incident response manager
Why it's wrong here
IR manager leads the technical response, not the CMT.
- ✓
Chief financial officer (CFO)
Why this is correct
CFO manages financial implications.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.