ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)
⚠ Common exam trap
The trap is selecting 'affected customers' or 'all employees' as immediate notifications because they seem most impacted — but best practice prioritizes legal/PR and internal management for controlled, authorized response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Legal and public relations
Option B (Legal and public relations) is correct because during a ransomware incident, legal counsel must be engaged immediately to assess regulatory notification obligations (e.g., GDPR, HIPAA, SEC disclosure rules) and preserve attorney-client privilege, while public relations manages external messaging to protect the organization's reputation and prevent misinformation. Option E (Internal management) is correct because executive leadership and management must be notified right away to authorize incident response actions, allocate resources, make critical business decisions, and fulfill their governance and oversight responsibilities. Option A (Affected customers) is not an immediate notification group; customer notification typically occurs after the scope of the breach is determined and legal/regulatory guidance is obtained, often with a defined timeline. Option C (All employees) is too broad for immediate notification, as mass communication can cause panic or leaks; only those with a need to know are informed initially. Option D (Competitors) has no legitimate role in incident response notification and would only expose the organization to further risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Affected customers
Why it's wrong here
Customers are notified after containment and impact assessment, not immediately; premature disclosure risks panic and legal missteps. This option is tempting because customer notification is a genuine regulatory and contractual obligation, and would be correct once forensic scope confirms which customer data was actually exfiltrated or encrypted.
- ✓
Legal and public relations
Why this is correct
Legal counsel and public relations must be engaged immediately because ransomware triggers regulatory breach-notification duties and reputational exposure. Legal assesses disclosure obligations, while PR controls messaging to customers, regulators and media. This satisfies the best-practise requirement to notify stakeholders whose functions cannot wait until containment completes.
- ✗
All employees
Why it's wrong here
Broadcasting to all employees before containment tips off the attacker and leaks details externally. Mass internal notification belongs to later crisis communication. It tempts because staff awareness aids phishing resistance, and would be right for a company-wide advisory after eradication, not during initial triage.
- ✗
Competitors
Why it's wrong here
Competitors have no incident-response role, no need-to-know, and no authority to act, so notifying them breaches confidentiality and could worsen the incident. It is tempting because external parties are sometimes informed after a breach, but that applies to regulators, insurers or law enforcement, not commercial rivals.
- ✓
Internal management
Why this is correct
Internal management requires immediate notification to authorise resource expenditure, declare the incident's severity and make business-continuity decisions. Executives own the risk acceptance and escalation path that the response team cannot assume. This satisfies the best-practise requirement to notify the stakeholders empowered to direct the organisation's response.
Go deeper
Related to this question
Learn chapter
Security Governance and Compliance
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.