CISM Incident Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To avoid the need for a chain of custody

  Why it's wrong here

  A retainer secures pre-vetted forensic expertise and agreed terms so evidence handling can begin immediately; it never removes the requirement to document custody. It is tempting because retainers streamline engagement, but chain of custody remains mandatory regardless of contractual arrangements.

• ✗

  To ensure the firm understands the organization's IT environment

  Why it's wrong here

  Familiarity with the environment is a benefit of ongoing engagement, not the key reason to retain forensics before an incident. It is tempting because responders do work faster when they know the estate, but the retainer's purpose is guaranteeing immediate availability of qualified investigators under pre-agreed terms.

• ✗

  To guarantee lower costs

  Why it's wrong here

  A retainer secures guaranteed availability of forensic examiners during an incident, not preferential pricing; cost certainty is incidental. It is tempting because retainers do fix rates in advance, which is genuinely useful for budgeting predictable engagements, but the pre-incident value lies in response readiness and evidence preservation.

• ✓

  To reduce the time needed to engage the firm when an incident occurs

  Why this is correct

  A retainer pre-negotiates rates, scope and contact details with the forensic firm, so engagement begins immediately when an incident strikes rather than after procurement and contracting delays. This directly reduces the time to engage, preserving volatile evidence.