A possible breach of an organization's IT system is reported by a project manager. Which of the following should the information security manager do FIRST?

The correct answer is D. Confirm the incident. The first step the information security manager should take is to confirm whether the reported breach is actually an incident. Once the incident is confirmed, appropriate containment, investigation, and remediation steps can be taken.

Submitted by haru.x· Apr 18, 2026Information Security Incident Management

Question

Options

AInvestigate the system logs.
BDisable access to the IT system.
CRun a port scan on the IT system.
DConfirm the incident.

How the community answered

(23 responses)

A
13% (3)
B
4% (1)
C
9% (2)
D
74% (17)

Explanation

The first step the information security manager should take is to confirm whether the reported breach is actually an incident. Once the incident is confirmed, appropriate containment, investigation, and remediation steps can be taken.

Topics

#Incident Response#Incident Identification#Incident Confirmation#First Responder Actions

Community Discussion

No community discussion yet for this question.

Full CISM Practice