A hacking group has posted an organization's employee data on social media. What should the information security manager do FIRST?

The correct answer is C. Initiate the incident response process. The first action the information security manager should take is to initiate the incident response process. This ensures a structured approach to handling the data breach, including containment, investigation, communication, and remediation actions. Once the incident response…

Submitted by chen.hong· Apr 18, 2026Information Security Incident Management

Question

A hacking group has posted an organization’s employee data on social media. What should the information security manager do FIRST?

Options

AEscalate to senior management.
BInform the impacted employees.
CInitiate the incident response process.
DEngage a forensic analysis team.

How the community answered

(57 responses)

A
18% (10)
B
9% (5)
C
70% (40)
D
4% (2)

Explanation

The first action the information security manager should take is to initiate the incident response process. This ensures a structured approach to handling the data breach, including containment, investigation, communication, and remediation actions. Once the incident response process is in motion, escalation to senior management, informing impacted employees, and engaging a forensic analysis team can occur as part of the response.

Topics

#Incident Response#Data Breach#Incident Management Process#First Steps

Community Discussion

No community discussion yet for this question.

Full CISM Practice