CISM Practice Question: Which THREE of the following are essential…

• ✓ A.Post-incident review process
• ✓ B.Communication escalation matrix
• ✓ C.Roles and responsibilities
• D.Network diagrams
• E.Disaster recovery procedures

Why A: The post-incident review process is a key component of an incident response plan because it ensures that lessons learned are captured and improvements are made to security controls and procedures. This phase, often aligned with the NIST SP 800-61 framework, involves analyzing the root cause, response effectiveness, and any gaps in detection or containment. Without this review, the organization cannot mature its incident response capabilities or prevent recurrence.

• ✓ A.A clear chain of command and escalation procedures.
• B.Automatic detection and response tools.
• C.Predefined response scripts for every possible incident.
• ✓ D.A communication plan for internal and external stakeholders.

Why A: A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.

• A.List of all employees' contact information
• B.Annual budget for incident response tools
• ✓ C.Communication and escalation matrix
• ✓ D.Incident response procedures
• ✓ E.Roles and responsibilities of team members

Why C: The communication and escalation matrix is a key component of an incident response plan because it defines the chain of command, contact paths, and escalation triggers for notifying stakeholders during an incident. This ensures that the right people are informed at the right time, preventing delays in decision-making and response actions. Without this matrix, critical incidents may be mishandled due to miscommunication or failure to escalate to senior management or legal teams.

• ✓ A.List of external contacts (law enforcement, legal, etc.).
• B.Annual budget for cybersecurity tools.
• ✓ C.Communication templates for internal and external stakeholders.
• D.Detailed step-by-step procedures for each incident type.
• ✓ E.Identification of incident response team members and roles.

Why A: An incident response plan must include a list of external contacts such as law enforcement, legal counsel, and regulatory bodies. This ensures that when a security incident occurs, the organization can quickly notify the appropriate authorities and comply with legal and regulatory requirements, such as breach notification laws under GDPR or HIPAA.

• ✓ A.Communication procedures for internal and external stakeholders.
• ✓ B.Roles and responsibilities of the response team.
• C.Detailed step-by-step technical instructions for all possible incidents.
• D.A list of pre-approved vendors for forensic services.
• ✓ E.A method for preserving and handling evidence.

Why A: A is correct because effective incident response requires structured communication procedures to coordinate with internal stakeholders (e.g., management, legal, PR) and external parties (e.g., law enforcement, regulators, customers). Without predefined communication channels, critical updates may be delayed or mishandled, increasing organizational risk.