Following an incident that resulted in significant impact to the organization the information security manager is tasked with establishing appropriate controls to prevent similar incidents in the…

Question

Options

• APerform a root cause analysis
• BImprove incident response procedures
• CReview the business impact analysis (BIA)
• DConduct lessons learned exercises

• A
  83% (35)
• B
  10% (4)
• C
  2% (1)
• D
  5% (2)

Explanation

Performing a root cause analysis (RCA) must come first because you cannot design effective controls without understanding why the incident happened - treating symptoms without knowing the cause risks building the wrong safeguards entirely. Option D (lessons learned) is closely related but is a broader, team-wide reflection activity that is informed by the RCA, not a prerequisite to it. Option B (improving incident response procedures) addresses how you respond to future incidents, not how you prevent them, and any improvements should be grounded in findings from the RCA. Option C (reviewing the BIA) helps prioritize assets and recovery objectives but is an input to planning, not a diagnostic step - the BIA was relevant before the incident occurred.

Memory tip: Think of RCA as the "why before the fix" rule - you must diagnose the root cause before prescribing any remedy, just like a doctor orders tests before writing a prescription.

No community discussion yet for this question.