CISM Incident Management Practice Question
During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?
⚠ Common exam trap
CISM often tests role clarity within the CMT — candidates confuse the communications lead's coordination duty with the technical, financial, or legal responsibilities owned by other CMT members.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Coordinating all external and internal communications
The communications lead on a Crisis Management Team (CMT) is specifically designated to own the communications function during an incident — both internal (employees, executives, board) and external (customers, media, regulators, law enforcement). This role ensures a single, consistent, approved message is delivered to all stakeholders, preventing conflicting or premature disclosures that could escalate reputational and legal exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Coordinating all external and internal communications
Why this is correct
The communications lead owns the single authoritative voice during a major incident, coordinating internal staff messaging and external stakeholder, media, and regulator communications. This prevents conflicting statements and satisfies the stem's requirement for unified crisis messaging under CMT direction.
- ✗
Authorizing financial expenditures for incident response
Why it's wrong here
Authorising financial expenditure rests with the finance lead or executive sponsor, who holds budget authority. The communications lead manages information flow and public statements during the crisis. Financial approval would be the correct answer only where the question asked about budget ownership, not communications.
- ✗
Directing technical containment efforts
Why it's wrong here
Directing technical containment belongs to the technical or incident response lead, who commands remediation actions. The communications lead coordinates messaging to employees, customers, regulators and media, and aligns statements with the CMT. Containment authority sits with the technical workstream, not communications.
- ✗
Preserving digital evidence for litigation
Why it's wrong here
Preserving digital evidence supports legal and forensic workstreams, not stakeholder messaging. The communications lead owns internal and external messaging, media handling and status updates during a major incident. Evidence preservation would fall to the forensics or legal function within the response structure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.