Question 502 of 871
CISM Information Security Program Practice Question
During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)
⚠ Common exam trap
The CISM exam often tests the misconception that accepting risk or implementing compensating controls is a valid substitute for updating the incident response plan, when in fact the plan must be comprehensive and inclusive of all critical assets to be effective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the incident response plan to include all critical systems
The incident response plan must be a living document that covers all critical systems to ensure a coordinated and effective response during a security incident. Excluding critical systems from the plan creates a blind spot that could lead to delayed containment, increased damage, or non-compliance with regulatory requirements. Updating the plan to include these systems is a direct corrective action that aligns with the CISM principle of maintaining an up-to-date incident response capability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement compensating controls on the excluded systems
Why it's wrong here
Compensating controls may reduce risk but do not address the missing plan coverage.
- ✗
Document the finding and accept the risk
Why it's wrong here
Accepting the risk without proper assessment and approval is not appropriate.
- ✗
Immediately remove the excluded systems from production
Why it's wrong here
This is too drastic and would disrupt business operations without proper analysis.
- ✓
Update the incident response plan to include all critical systems
Why this is correct
Updating the plan directly closes the gap identified in the audit.
- ✓
Escalate the issue to senior management for decision
Why this is correct
Escalation ensures management awareness and provides authority to take corrective action.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.