CISM Incident Management Practice Question
What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?
⚠ Common exam trap
CISM often tests the tension between speed and thoroughness in post-incident activities — candidates who equate 'sooner is always better' incorrectly select 24 hours, while those who prioritize completeness over timeliness select 1 month.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Within 2 weeks
A lessons learned meeting is most effective when held within 2 weeks of incident resolution, while details are still fresh in participants' memories but after immediate recovery pressures have subsided. This window allows time to gather facts, review logs, and prepare meaningful discussion points without losing critical context. CISM best practice emphasizes timely but not rushed post-incident reviews to capture actionable improvements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Within 2 weeks
Why this is correct
Holding the meeting within two weeks captures recollections while still fresh, before details fade, yet allows enough time to gather evidence and complete initial investigation. Longer delays erode accuracy and weaken the corrective actions derived.
- ✗
Within 1 month
Why it's wrong here
Waiting up to a month lets recollection fade and staff disperse, weakening the accuracy of findings; lessons learned should be captured promptly while details are fresh. A month-long window suits scheduled post-incident reviews of low-severity events, not timely knowledge capture.
- ✗
Within 3 months
Why it's wrong here
Three months lets staff memories fade and evidence go stale, so root causes and response gaps are reconstructed unreliably. It is tempting because long-running incidents or regulatory reviews can delay formal closure, but the meeting should follow resolution closely, not a quarterly cycle.
- ✗
Within 24 hours
Why it's wrong here
Twenty-four hours is often too soon: the incident may still be active, and responders lack verified timelines or complete evidence. It is tempting because capturing fresh recollections quickly is valuable, and it would suit a short, contained incident where resolution and stand-down are already confirmed.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.