CISM · Question #222
Which of the following is the MOST cost-effective method for assessing an organization's incident response capabilities?
The correct answer is B. Tabletop exercise. Tabletop exercises are the most cost-effective way to assess incident response capabilities because they involve walking key stakeholders through a simulated scenario using discussion only - no special infrastructure, disruption to operations, or expensive external consultants re
Question
Which of the following is the MOST cost-effective method for assessing an organization's incident response capabilities?
Options
- APenetration testing
- BTabletop exercise
- CThird-party assessment
- DSenior management interview
How the community answered
(36 responses)- A3% (1)
- B94% (34)
- C3% (1)
Explanation
Tabletop exercises are the most cost-effective way to assess incident response capabilities because they involve walking key stakeholders through a simulated scenario using discussion only - no special infrastructure, disruption to operations, or expensive external consultants required.
- Penetration testing (A) is costly, requires skilled testers, and focuses on finding vulnerabilities rather than evaluating how the team responds to incidents.
- Third-party assessments (C) provide valuable outside perspective but carry significant consulting fees, making them far less cost-effective.
- Senior management interviews (D) give insight into awareness and policy-level understanding, but don't actually test the team's hands-on response capability.
Memory tip: Think "tabletop = talk it out around a table" - it's low-cost, low-risk, and high-value for stress-testing your incident response plan without touching production systems.
Topics
Community Discussion
No community discussion yet for this question.