An organization's information security manager has been alerted to a possible security incident related to a system intrusion. Which of the following should be the information security manager's…

The correct answer is D. Verify an incident occurred. The first step in responding to a possible security incident is to verify whether an actual incident has occurred. This helps avoid unnecessary actions and ensures resources are used appropriately. Once verified, further steps such as activating the incident response plan or…

Submitted by marco_it· Apr 18, 2026Information Security Incident Management

Question

An organization's information security manager has been alerted to a possible security incident related to a system intrusion. Which of the following should be the information security manager's FIRST course of action?

Options

AReport the situation to senior management.
BMobilize resources to limit the damage.
CActivate the incident response plan.
DVerify an incident occurred.

How the community answered

(34 responses)

A
3% (1)
B
12% (4)
C
6% (2)
D
79% (27)

Explanation

The first step in responding to a possible security incident is to verify whether an actual incident has occurred. This helps avoid unnecessary actions and ensures resources are used appropriately. Once verified, further steps such as activating the incident response plan or mobilizing resources can be taken.

Topics

#Incident response#Incident verification#Incident management lifecycle#Detection and analysis

Community Discussion

No community discussion yet for this question.

Full CISM Practice