easyMultiple ChoiceObjective-mapped
CISM Practice Question: During an incident, the incident response team is…
During an incident, the incident response team is communicating with affected stakeholders. According to best practices, which of the following should be communicated FIRST?
⚠ Common exam trap
The CISM exam often tests the misconception that stakeholders need technical depth immediately, but the trap here is that candidates confuse 'first communication' with 'final report' and select root cause or timeline, forgetting that early incident response prioritizes containment status over investigation details.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A summary of actions taken so far
During an incident, the first communication to stakeholders should provide a summary of actions taken so far to establish transparency and demonstrate that the incident response team is actively managing the situation. This aligns with NIST SP 800-61r2 guidance, which prioritizes timely, high-level updates over detailed technical data to avoid overwhelming stakeholders and to maintain trust. Detailed technical analysis, timelines, and root cause determination typically require more investigation and are communicated in subsequent updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A summary of actions taken so far
Why this is correct
A high-level summary keeps stakeholders informed while the team works on deeper analysis.
- ✗
Detailed technical analysis
Why it's wrong here
Detailed technical analysis is shared later once the investigation is complete and confirmed.
- ✗
A timeline of all events
Why it's wrong here
A timeline is developed as the investigation progresses and is not typically shared in the initial communication.
- ✗
The root cause of the incident
Why it's wrong here
Root cause is determined during post-incident analysis, not at the start.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.