CISM · Question #137
Which of the following is MOST important to include in security incident escalation procedures?
The correct answer is D. Notification criteria. Escalation procedures exist to ensure the right people are informed at the right time. Notification criteria define the specific thresholds, triggers, and conditions that determine when escalation is required and who must be notified-without these criteria, escalation becomes…
Question
Which of the following is MOST important to include in security incident escalation procedures?
Options
- ARecovery procedures
- BContainment procedures
- CKey objectives of the security program
- DNotification criteria
How the community answered
(28 responses)- A7% (2)
- B4% (1)
- D89% (25)
Explanation
Escalation procedures exist to ensure the right people are informed at the right time. Notification criteria define the specific thresholds, triggers, and conditions that determine when escalation is required and who must be notified-without these criteria, escalation becomes inconsistent and ad hoc. Recovery procedures (A) and containment procedures (B) are critical parts of incident response plans, but they are not specific to escalation; they are executed regardless of escalation. Key security program objectives (C) belong in policy documents, not escalation procedures. Notification criteria are the operational core of escalation.
Topics
Community Discussion
No community discussion yet for this question.