CISM Incident Management Practice Question
When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?
⚠ Common exam trap
CISM often tests the misconception that incident response should always continue until full recovery, when in fact MTD breach requires escalation to BC/DR for continuity activation decisions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate to the BC/DR team for possible activation of continuity plans
The Maximum Tolerable Downtime (MTD) is the longest time a business process can be unavailable before causing unacceptable impact. When an incident cannot be resolved within the MTD, the appropriate action is to escalate to the BC/DR team so they can decide whether to activate continuity plans (e.g., failover to alternate sites, manual workarounds). Continuing incident response past the MTD without invoking BC/DR risks exceeding the organization's tolerance for downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the MTD and focus solely on incident eradication
Why it's wrong here
Ignoring the MTD abandons the agreed recovery threshold, extending outage beyond tolerable limits instead of activating BC/DR. It is tempting because eradication feels like resolving the root cause, and focusing on eradication is right while the incident remains within MTD.
- ✗
Continue incident response until full recovery
Why it's wrong here
Exceeding the MTD means the incident has become a disaster, so BC/DR plans must be invoked; continuing response delays recovery beyond tolerable limits. It is tempting because eradication restores normal operations, and continuing would suit incidents still within MTD.
- ✗
Declare a disaster immediately without further analysis
Why it's wrong here
Declaring a disaster requires the MTD breach plus assessment confirming recovery cannot occur in time; skipping analysis risks invoking BC/DR unnecessarily. It is tempting because MTD breach is the trigger, but the correct action is a formal, assessed declaration following the plan's criteria.
- ✓
Escalate to the BC/DR team for possible activation of continuity plans
Why this is correct
Once recovery cannot meet the maximum tolerable downtime, the incident exceeds IT response capability and becomes a business continuity matter. Escalating to the BC/DR team enables assessment and possible activation of continuity plans to sustain critical business functions.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.