Within an incident response plan, which of the following MUST be done before an incident is escalated?

The correct answer is B. Determine the severity of the incident. Before an incident is escalated within an incident response plan, it is essential to determine the severity of the incident. Assessing the severity helps in deciding whether the incident warrants escalation and which resources and personnel need to be involved in the response…

Submitted by tunde_lagos· Apr 18, 2026Information Security Incident Management

Question

Options

AQuantify the risk associated with the incident.
BDetermine the severity of the incident.
CDetermine the root cause of the incident.
DQuantify the financial impact of the incident.

How the community answered

(34 responses)

A
3% (1)
B
94% (32)
C
3% (1)

Explanation

Before an incident is escalated within an incident response plan, it is essential to determine the severity of the incident. Assessing the severity helps in deciding whether the incident warrants escalation and which resources and personnel need to be involved in the response. While quantifying risk, determining root causes, and assessing financial impact are important steps in incident management, determining severity is the immediate action that guides the escalation process.

Topics

#Incident Response#Incident Escalation#Incident Triage#Incident Severity

Community Discussion

No community discussion yet for this question.

Full CISM Practice