CISM Incident Management Practice Question
Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?
⚠ Common exam trap
Candidates often confuse technical severity (e.g., a DDoS causing downtime) with business/regulatory impact, failing to recognize that only incidents with legal or reputational fallout (like a PII breach) necessitate CMT activation, not merely high technical severity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A P1 data breach involving customer personally identifiable information (PII).
A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A P1 data breach involving customer personally identifiable information (PII).
Why this is correct
High impact data breaches demand strategic decisions and external communication.
- ✗
A P2 denial-of-service attack that is quickly mitigated.
Why it's wrong here
If quickly mitigated, impact may be limited; CMT may not be needed.
- ✗
A P4 phishing email reported by a user.
Why it's wrong here
P4 incidents have minimal impact and do not require CMT.
- ✗
A P3 insider threat involving an employee accessing unauthorized files.
Why it's wrong here
P3 has limited impact; HR may handle it without CMT.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.