An information security manager learns that a third-party data processor has been compromised by a cyberattack. Which of the following should be done FIRST?

The correct answer is D. Categorize and document the incident. The first step when learning about a third-party data processor compromise is to categorize and document the incident. This ensures a clear understanding of the scope, impact, and severity of the situation, enabling an appropriate and coordinated response in line with the…

Submitted by kevin_r· Apr 18, 2026Information Security Incident Management

Question

Options

ARequire a scan and reboot of affected IT systems.
BEscalate the incident to senior management.
CRequire a shutdown of affected IT systems.
DCategorize and document the incident.

How the community answered

(36 responses)

A
19% (7)
B
8% (3)
C
3% (1)
D
69% (25)

Explanation

The first step when learning about a third-party data processor compromise is to categorize and document the incident. This ensures a clear understanding of the scope, impact, and severity of the situation, enabling an appropriate and coordinated response in line with the organization's incident response plan.

Topics

#Incident Response#Incident Categorization#Initial Incident Handling#Documentation

Community Discussion

No community discussion yet for this question.

Full CISM Practice